CCES (Harmony Endpoint Specialist) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Endpoint Security Management Server

Central component that stores policy and the endpoint database, distributes policy and signatures, and hosts the management console used by administrators.

Endpoint Security Client

Agent installed on each endpoint that enforces policy locally, runs anti-malware and threat prevention engines, and reports telemetry to the management server.

Distributed deployment

Architecture where one management server controls endpoints across remote sites, often with local gateways, reducing WAN traffic and latency for policy and signature distribution.

Management high availability

A standby management server with replicated database that takes over if the primary fails, preserving policy and logs with minimal interruption to endpoint management.

Deployment rule

Rule that targets endpoint groups for automatic agent installation or upgrade, letting administrators roll out software to many machines without manual installs.

Agent communication port

Network port, commonly 443, used by the endpoint agent to reach the management server for policy, signatures, and telemetry; must be allowed through firewalls.

Policy rule

Entry with source, destination, service, action, and tracking evaluated top-down; the first matching rule determines how the blade handles the traffic or file.

Blade enablement

Per-policy and per-rule switch that turns on a specific protection such as Anti-Malware or Firewall, so one rule can enforce only selected protections.

Install Policy

Action that pushes the current policy version to endpoints; changes are not enforced until installation succeeds, and failures leave the prior policy active.

Exception precedence

Order in which exceptions apply: endpoint-level overrides rule-level, which overrides global; the most specific exception wins for a given detection.

Compliance rule

Policy check for required endpoint settings such as signature age or encryption; non-compliant endpoints can be restricted or blocked from network access.

Policy audit trail

Record of who changed and installed policy versions; used to trace the origin of a configuration change during troubleshooting or incident review.

On-access scanning

Real-time anti-malware scan triggered when a file is opened, executed, or written, blocking malicious files before they run.

On-demand scanning

Scheduled or manual full scan of endpoint storage using the same signature and heuristic engines as real-time scanning, typically run off-hours.

Signature update distribution

Process where the management server pulls new malware signatures and pushes them to agents; signature age is tracked as a compliance metric.

Behavioral threat prevention

Detection based on process behavior such as credential dumping or mass file encryption, blocking malicious activity even without a matching signature.

Quarantine

Action that moves a detected file into a protected store so it cannot execute, with the option to restore it later if the detection is a false positive.

Hash-based exclusion

Exclusion keyed to a file's cryptographic hash, which is safer than a path exclusion because a renamed or replaced file will not inherit the exclusion.

Ransomware protection

Behavioral detection of mass file modification plus protected folders that only trusted processes may write to, limiting encryption damage.

Threat emulation

Detonation of suspicious files in a sandbox to observe behavior; verdicts are returned to endpoints and can become new signatures.

Endpoint isolation

Containment action that cuts an endpoint off from the network while keeping the management channel open so administrators can investigate and remediate.

Forensic capture

Collection of memory or disk evidence from an endpoint through the console; performed before remediation because cleanup destroys volatile evidence.

Chain of custody

Documentation of who collected evidence, when, how, and where it is stored, plus hashes proving the evidence was not altered.

Threat hunting query

Search of endpoint telemetry for indicators such as a hash, process name, command line, or network destination across the whole estate.

Incident response phases

Detect, triage, contain, eradicate, recover, and lessons learned; each phase is logged so the incident timeline can be reconstructed.

Root cause analysis

Correlating the infection vector with endpoint telemetry to determine how the compromise started and which policy change would prevent recurrence.

Remediation verification

Confirming that quarantine, deletion, or process termination succeeded by rescanning the endpoint and checking that the threat no longer appears.

Threat log

Record of detections and actions taken by protection blades, used for triage, reporting, and identifying recurring threats across the estate.

Audit log

Record of administrator actions and configuration changes, used to trace policy changes and satisfy compliance evidence requirements.

Endpoint offline status

Condition where the agent has not contacted the server recently, usually caused by connectivity, proxy, or certificate problems, creating a protection gap.

Policy hit count

Counter showing how often a rule matched; used to detect shadowed or unused rules and confirm which rule is handling traffic.

Agent health monitoring

Console view of agent service status and last communication time; a stopped or tampered agent service is treated as a security event.