View Full Checkpoint 156-536 Exam Dumps and Practice Test Dumps.

Question 221. What stores Endpoint policies and monitoring data?

1. SmartEndpoint client
2. Active Directory
3. Endpoint Security Database
4. ThreatCloud

Correct Answer: 3. Endpoint Security Database

Explanation:

The Endpoint Security Database is part of the Endpoint Security Management Server architecture. It stores information required to manage endpoint protection, including policies enforced on endpoint clients, user and computer objects, licensing information, and endpoint monitoring data. Centralizing this information allows administrators to manage large numbers of endpoints consistently. The database works with other management-server services to distribute policies and maintain endpoint status. It should not be confused with Active Directory, which provides directory information, or ThreatCloud, which supplies threat intelligence.

Question 222. What does SmartEndpoint mainly provide?

1. Endpoint deployment and management
2. DNS resolution
3. Disk recovery only
4. Gateway routing

Correct Answer: 1. Endpoint deployment and management

Explanation:

SmartEndpoint is a Check Point management application used to deploy, monitor, and configure Endpoint Security clients and policies. It provides administrators with a centralized interface for endpoint-related operations in on-premises deployments. SmartEndpoint can be installed directly on the Endpoint Security Management Server or on a supported Windows management computer. It interacts with management services rather than directly replacing the endpoint client itself. The endpoint client runs on user devices and enforces the security policy received from the management environment.

Question 223. What does an Endpoint Security Client enforce?

1. Gateway routing
2. DNS policy
3. Active Directory replication
4. Endpoint security policy

Correct Answer: 4. Endpoint security policy

Explanation:

The Endpoint Security Client is installed on managed end-user computers and is responsible for enforcing the security policy assigned by the management environment. It also monitors the endpoint’s security state and communicates with Endpoint Security servers to receive policy updates, component updates, and protection information. Different endpoint components can be installed according to organizational requirements. The client therefore acts as the enforcement point on the protected device, while the Endpoint Security Management Server provides centralized policy and administrative control.

Question 224. What does the Directory Scanner retrieve?

1. Malware signatures
2. Active Directory structure
3. Browser history
4. Gateway objects

Correct Answer: 2. Active Directory structure

Explanation:

The Directory Scanner retrieves the structure and contents of Active Directory so endpoint policies can be assigned using directory-based information. This lets administrators work with organizational units, computers, users, and related directory objects when defining endpoint policy scope. In traditional Endpoint Security architecture, the Directory Scanner is associated with the Endpoint Security Management Server. Current web-management deployments also provide Active Directory synchronization options for keeping organizational information current. Directory information supports policy targeting but does not replace the Endpoint Security Database or the endpoint clients themselves.

Question 225. Who initiates client-server connections?

1. Endpoint client
2. Policy Server
3. SmartEndpoint
4. Domain Controller

Correct Answer: 1. Endpoint client

Explanation:

Check Point documents that the Endpoint Security client is always the initiator of connections to the Endpoint Policy Server or Endpoint Security Management Server. This client-initiated communication model is important when designing firewall rules and troubleshooting connectivity. Administrators must ensure that required routes and ports from endpoint clients toward the relevant Endpoint Security servers are available. If those connections are blocked, registration, policy downloads, key retrieval, and other endpoint-management operations can fail even though the server itself is functioning correctly.

Question 226. Which port handles most client-server communication?

1. TCP/22
2. TCP/53
3. TCP/18190
4. TCP/443

Correct Answer: 4. TCP/443

Explanation:

Most Endpoint Security client-to-server communication uses HTTPS over TCP port 443. Check Point documents examples including endpoint registration, policy downloads, and retrieval of new file-encryption keys. Communication uses TLS encryption, helping protect management traffic in transit. Because this port is critical to endpoint operation, firewall or application-control rules must permit the required HTTPS communication between managed clients and their Endpoint Security Management Server or Endpoint Policy Server. Connectivity problems on TCP/443 can therefore cause several apparently unrelated endpoint-management failures.

Question 227. How are downloaded policy files protected?

1. With DES
2. With AES encryption
3. With plain text
4. With MD5 only

Correct Answer: 2. With AES encryption

Explanation:

Endpoint Security policy files transferred to clients are encrypted with AES. The policy is delivered over secure HTTPS communication, providing protection for both the transport channel and the policy content itself. This helps prevent unauthorized parties from easily reading or tampering with endpoint policy information while it is being distributed. Administrators still need correct routing and firewall configuration so endpoints can reach the management environment. Encryption protects the data in transit, but it does not compensate for blocked communication paths or incorrectly configured Endpoint Security servers.

Question 228. What does SIC provide?

1. Malware scanning
2. Disk encryption
3. Authenticated server communication
4. URL filtering

Correct Answer: 3. Authenticated server communication

Explanation:

Secure Internal Communication, or SIC, provides authenticated communication between Check Point management components. In Endpoint Security architecture, SIC is used for communication between SmartEndpoint and Endpoint Security Management Servers and between Endpoint Policy Servers and Endpoint Security Management Servers. The components authenticate each other using certificates. SIC is different from ordinary endpoint client traffic, which primarily uses HTTPS. When troubleshooting server-to-server or management-console communication, administrators should therefore distinguish SIC problems from client HTTPS connectivity problems.

Question 229. Which ports are used for SmartEndpoint SIC?

1. TCP/80-81
2. TCP/443-444
3. TCP/22-25
4. TCP/18190-18193

Correct Answer: 4. TCP/18190-18193

Explanation:

Check Point documents TCP ports 18190 through 18193 for SIC communication involving SmartEndpoint and Endpoint Security Management Servers. The same range is also used for SIC communication between an Endpoint Policy Server and the management environment. These ports are separate from TCP/443, which handles most client-to-server HTTPS communication. When troubleshooting management-console connectivity or Policy Server communication, administrators should verify that required SIC ports are not blocked by network or firewall controls.

Question 230. What is an Endpoint Policy Server used for?

1. Reducing client-server communication load
2. Performing full-disk recovery
3. Running Appscan
4. Replacing Active Directory

Correct Answer: 1. Reducing client-server communication load

Explanation:

An Endpoint Policy Server is an optional architecture component used to distribute and reduce the load of communication between endpoint clients and the Endpoint Security Management Server. This can be valuable in larger or distributed environments where many endpoint clients would otherwise communicate directly with the primary management system. Policy Servers communicate with the Endpoint Security Management Server through SIC and can send monitoring events toward Primary Management over HTTPS. Their role is therefore largely related to scalability and communication distribution rather than replacing centralized policy management.

Question 231. What is enabled by default for AD discovery?

1. Full AD Sync
2. Manual LDAP import
3. Organization Distributed Scan
4. Local CSV import

Correct Answer: 3. Organization Distributed Scan

Explanation:

Organization Distributed Scan is enabled by default in Harmony Endpoint web management. With this method, each Endpoint client reports its own Active Directory path to the Security Management Server. This allows the management environment to learn organizational placement from devices that already have Endpoint Security installed. The method does not discover unmanaged devices because only installed Endpoint clients report their paths. Organizations needing a broader directory view can instead configure Full Active Directory Sync with a designated directory-scanning endpoint.

Question 232. How often does each client report its AD path by default?

1. Every 15 minutes
2. Every 120 minutes
3. Every 8 hours
4. Daily

Correct Answer: 2. Every 120 minutes

Explanation:

With Organization Distributed Scan, each Endpoint client sends its Active Directory path to the Security Management Server every 120 minutes by default. This provides periodic updates about where managed devices are located in the directory structure. Because only computers with Endpoint Security installed send this information, unmanaged directory objects are not discovered through this mechanism. Administrators needing complete Active Directory visibility can configure Full Active Directory Sync instead. The reporting interval helps balance current directory information with communication overhead from large endpoint populations.

Question 233. How many endpoint clients act as the scanner in Full AD Sync?

1. All clients
2. Two clients
3. One per user
4. One designated client

Correct Answer: 4. One designated client

Explanation:

Full Active Directory Sync uses one designated Endpoint client as the Active Directory scanner. That client connects to the configured domain controller, gathers directory information, and sends the results to the Security Management Server. Administrators specify the scanner computer, AD login details, domain controller, port, LDAP path, synchronization interval, and communication settings. This centralized scanning approach differs from Organization Distributed Scan, where every managed endpoint reports only its own directory path.

Question 234. What happens when a new full AD scanner is created?

1. Organization Distributed Scan is disabled
2. Endpoint policy is deleted
3. All clients uninstall
4. Threat Prevention turns off

Correct Answer: 1. Organization Distributed Scan is disabled

Explanation:

When an administrator creates a new Active Directory scanner for Full Active Directory Sync, Harmony Endpoint automatically disables Organization Distributed Scan. The environment then relies on the designated scanner to retrieve directory information rather than having each Endpoint client independently report its own path. This prevents the two synchronization approaches from operating simultaneously in conflicting ways. Administrators can manage scanner configuration through Computer Management or Endpoint Settings and should verify scanner connectivity and directory credentials after making the change.

Question 235. What is recommended for scanner-to-DC communication?

1. FTP
2. SSL
3. Telnet
4. TFTP

Correct Answer: 2. SSL

Explanation:

Check Point recommends using SSL for communication between the designated Active Directory scanner and the Domain Controller. The scanner configuration includes a checkbox to enable SSL communication, helping protect directory credentials and information exchanged during synchronization. Administrators also configure the domain controller name, port, LDAP path, login credentials, and synchronization interval. Using encrypted directory communication is preferable to transmitting sensitive authentication and directory data without transport protection, particularly in enterprise networks where the scanner may communicate across several network segments.

Question 236. What does the LDAP path identify?

1. Malware database
2. Endpoint package
3. Directory location to scan
4. Policy log file

Correct Answer: 3. Directory location to scan

Explanation:

The LDAP path identifies the directory location that the Active Directory scanner should query during Full Active Directory Sync. It tells the scanner which directory server structure or path contains the objects that need to be synchronized with Harmony Endpoint management. The scanner configuration also includes domain-controller details, credentials, communication settings, and synchronization frequency. Correct LDAP information is essential because an incorrect path may cause expected directory objects to be missing even if the scanner successfully authenticates to the domain controller.

Question 237. What does the term Endpoint Security Management Server include?

1. Only SmartEndpoint
2. Only Domain Controllers
3. Endpoint clients only
4. Management and optional Policy Servers

Correct Answer: 2. Management and optional Policy Servers

Explanation:

Check Point uses the term Endpoint Security Management Server broadly in some architecture documentation to refer to the Endpoint Security servers in the environment, including the primary Endpoint Security Management Server and optional Endpoint Policy Servers. The primary management system contains centralized policy and database services, while Policy Servers can distribute client communication load. Understanding this terminology is useful because architecture diagrams and troubleshooting documentation may use the broader server term when referring to several Endpoint Security server roles collectively.

Question 238. Which service sends monitoring events from a Policy Server to Primary Management?

1. DNS
2. SSH
3. SMTP
4. HTTPS

Correct Answer: 4. HTTPS

Explanation:

Endpoint Policy Servers use HTTPS over TCP/443 to send monitoring events to Primary Management. Server-to-server policy and management communication can use SIC for other functions, but Check Point specifically identifies HTTPS as the transport used for monitoring-event communication from the Policy Server toward Primary Management. Understanding these separate communication methods is useful when troubleshooting distributed deployments because blocking one service may affect monitoring while other Endpoint Security operations continue to function normally.

Question 239. What must exist between Endpoint Security elements?

1. Routing
2. RAID
3. Shared passwords
4. Appscan XML

Correct Answer: 3. Routing

Explanation:

Check Point states that routing must exist between Endpoint Security elements for the architecture to function correctly. Required TCP services must also be allowed through firewall or application-control policies. Even when all servers and clients are correctly configured, communication cannot succeed if the network has no valid route between them. Troubleshooting should therefore include basic network reachability before focusing only on application settings. Verifying routing and required ports can quickly identify the cause of endpoint registration, policy-download, Policy Server, or management-console communication failures.

Question 240. What BEST improves scalability in a large endpoint deployment?

1. Add Endpoint Policy Servers
2. Disable HTTPS
3. Remove directory scanning
4. Put all clients on one subnet

Correct Answer: 1. Add Endpoint Policy Servers

Explanation:

Endpoint Policy Servers can improve scalability by distributing client communication and reducing the direct communication load on the Endpoint Security Management Server. This is especially useful when an organization manages a large or geographically distributed population of endpoints. The Check Point Certified Harmony Endpoint Specialist course explicitly includes large-scale Harmony Endpoint deployment and deployment of additional Endpoint Security management infrastructure among its objectives. Policy Servers therefore provide a supported architectural method for scaling communication rather than simply increasing network concentration around the primary server.