I85PREP
⌘ K
CCES (Harmony Endpoint Specialist) study materials
CCES (Harmony Endpoint Specialist) study resources

CCES (Harmony Endpoint Specialist) practice questions

One question at a time. Build your CCES (Harmony Endpoint Specialist) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Harmony Endpoint deployment and architecture

In a Harmony Endpoint deployment, which component is installed on the endpoint itself and enforces the security policy received from the management server?

  1. Web management console
  2. Management server
  3. Policy deployment appliance
  4. Endpoint Security client Correct answer.

Explanation

The Endpoint Security client is the agent installed on each protected machine; it receives policy from the management server and enforces it locally, including anti-malware, firewall, and other blades. The management server distributes policy but does not sit on the endpoint.

Question 2Harmony Endpoint deployment and architecture

Which Harmony Endpoint component provides the browser-based interface administrators use to configure policies and view endpoint status?

  1. The web management console Correct answer.
  2. The endpoint agent
  3. The policy repository database
  4. The ThreatCloud service

Explanation

The web management console is the administrative front end served by the management server, where administrators create policies, assign them to groups, and review endpoint compliance. It is an interface layer, not an enforcement or reputation service.

Question 3Harmony Endpoint deployment and architecture

An administrator wants endpoints to receive updated policy without reinstalling the client. What is the standard mechanism for delivering policy changes to already-installed clients?

  1. Replacing the endpoint license file
  2. Manual registry edits on each host
  3. Policy deployment from the management server Correct answer.
  4. Reimaging each endpoint

Explanation

Policy changes made on the management server are pushed to connected clients, which then apply the updated rules. This centralized deployment avoids reinstalling or manually touching each endpoint.

Question 4Harmony Endpoint deployment and architecture

Which statement best describes the role of ThreatCloud in a Harmony Endpoint architecture?

  1. It supplies reputation and threat intelligence used by endpoint protections. Correct answer.
  2. It stores endpoint disk images for recovery.
  3. It replaces the management server for small deployments.
  4. It provides the VPN tunnel between endpoints.

Explanation

ThreatCloud is the cloud intelligence service that feeds reputation data and threat indicators to Harmony protections, helping clients identify malicious files, URLs, and behaviors. It complements rather than replaces the management server.

Question 5Harmony Endpoint deployment and architecture

What is the purpose of organizing endpoints into groups on the Harmony Endpoint management server?

  1. To encrypt endpoint hard drives
  2. To allocate IP addresses to endpoints
  3. To assign a common policy and settings to a set of endpoints Correct answer.
  4. To physically segment network switches

Explanation

Groups let administrators apply a shared policy and configuration to many endpoints at once, simplifying management at scale. Grouping is a logical administrative construct and does not perform network segmentation, disk encryption, or DHCP duties.

Question 6Harmony Endpoint deployment and architecture

Which deployment model keeps the Harmony Endpoint management server on the organization's own infrastructure rather than in the vendor cloud?

  1. Software-as-a-service console
  2. Agentless scanning
  3. Cloud-hosted management
  4. On-premises management Correct answer.

Explanation

An on-premises deployment places the management server on the organization's own infrastructure, giving local control over data and connectivity. Cloud-hosted management instead runs the server in a vendor-managed environment.

Question 7Harmony Endpoint deployment and architecture

Before an endpoint can be managed by a Harmony Endpoint server, what must the client establish so it can receive policy?

  1. A second operating system partition
  2. A static public IP address
  3. A direct connection to the vendor's billing portal
  4. A trust relationship and communication channel with the management server Correct answer.

Explanation

The client must register with and trust the management server, establishing a communication channel over which policy and updates flow. Without this relationship the server cannot manage or deliver policy to the endpoint.

Question 8Harmony Endpoint deployment and architecture

Which license attribute determines whether a given endpoint is entitled to receive Harmony Endpoint protection?

  1. The endpoint's screen resolution
  2. The endpoint's MAC address
  3. The management server's hostname
  4. The assigned license and its seat count Correct answer.

Explanation

Entitlement is governed by the assigned license and the number of seats it covers; endpoints beyond the licensed count are not entitled to protection. Hardware attributes and naming do not determine entitlement.

Question 9Harmony Endpoint deployment and architecture

An organization runs the management server behind a firewall and endpoints connect over the internet. Which consideration is most important for reliable client-server communication?

  1. Assigning every endpoint a public address
  2. Allowing the required management and update ports between clients and the server Correct answer.
  3. Disabling the endpoint firewall blade
  4. Blocking all outbound HTTPS traffic from endpoints

Explanation

Clients must be able to reach the management server on the ports used for management and updates; firewall rules should permit that traffic. Blocking HTTPS or disabling protection would break functionality rather than enable it.

Question 10Harmony Endpoint deployment and architecture

A security team wants a small pilot group of endpoints to receive a stricter policy while the rest keep the current one. What is the most appropriate approach?

  1. Reinstall the client on all endpoints
  2. Remove the pilot endpoints from management
  3. Place the pilot endpoints in a separate group with the stricter policy assigned Correct answer.
  4. Change the global default policy for everyone

Explanation

Assigning the stricter policy to a dedicated group scopes the change to the pilot while leaving other endpoints on their existing policy. Global changes or reinstalls would affect the whole estate unnecessarily.

Question 11Harmony Endpoint deployment and architecture

During rollout, an administrator notices some endpoints show as unmanaged in the console. Which cause is most consistent with this symptom?

  1. The console browser is set to a different language
  2. The clients have not completed registration with the management server Correct answer.
  3. The endpoints have too much free disk space
  4. The endpoints use the latest operating system patch

Explanation

Endpoints appear unmanaged when their clients have not registered or cannot reach the management server, so no policy is applied. Disk space, patch level, and browser language do not determine management status.

Question 12Harmony Endpoint deployment and architecture

Which Harmony Endpoint architectural element is responsible for storing logs and events generated by endpoint clients for later review?

  1. The endpoint's BIOS
  2. The ThreatCloud reputation feed
  3. The management server's logging and database components Correct answer.
  4. The endpoint's graphics driver

Explanation

Endpoint clients forward events to the management server, whose logging and database components store them for reporting and investigation. ThreatCloud provides intelligence rather than local event storage.

Question 13Harmony Endpoint deployment and architecture

An administrator must ensure endpoints continue to be protected even when they are offline and cannot reach the management server. What design principle supports this?

  1. The server pushes policy only while the user is logged in
  2. The endpoint relies on the console to block threats
  3. The client disables all protection until it reconnects
  4. The client enforces locally cached policy independent of server connectivity Correct answer.

Explanation

Harmony Endpoint clients enforce locally held policy, so protection continues when the endpoint is offline or cannot reach the server. Protection is not suspended merely because connectivity is lost.

Question 14Harmony Endpoint deployment and architecture

A company wants centralized visibility across endpoints in multiple branch offices without deploying a server in each branch. Which approach fits the Harmony Endpoint architecture?

  1. Install an independent management server on every endpoint
  2. Point branch clients to a central management server reachable over the WAN or internet Correct answer.
  3. Rely on each branch's local antivirus only
  4. Disable logging at the branches

Explanation

Clients in remote branches can report to and receive policy from a single central management server as long as connectivity and required ports are available. This preserves centralized visibility without per-branch servers.

Question 15Harmony Endpoint deployment and architecture

What does the management server use to identify and authenticate an endpoint client during registration?

  1. The endpoint's monitor model
  2. The endpoint's wallpaper setting
  3. The user's email signature
  4. A unique client identity established during enrollment Correct answer.

Explanation

Each client obtains a unique identity during enrollment, which the server uses to authenticate and track that endpoint. Cosmetic or unrelated attributes play no part in registration identity.

Question 16Harmony Endpoint deployment and architecture

An administrator needs to verify that a newly installed client is receiving the correct policy. Which action best confirms this?

  1. Reboot the endpoint repeatedly
  2. Check the endpoint's status and applied policy in the management console Correct answer.
  3. Delete the endpoint from the console
  4. Disable the endpoint's network adapter

Explanation

The management console reports each endpoint's status and the policy currently applied, allowing the administrator to confirm correct assignment. Destructive or disruptive actions do not verify policy delivery.

Question 17Harmony Endpoint deployment and architecture

Which factor most directly affects sizing of the Harmony Endpoint management server?

  1. The number of USB ports on endpoints
  2. The number of managed endpoints and the volume of logs they generate Correct answer.
  3. The color scheme of the web console
  4. The brand of endpoint monitors

Explanation

Server sizing depends primarily on how many endpoints are managed and the resulting volume of events and logs stored and processed. Cosmetic and hardware-peripheral details do not influence capacity planning.

Question 18Harmony Endpoint deployment and architecture

A regulated customer requires that endpoint security data remain within their own data center. Which deployment choice satisfies this requirement?

  1. Agentless cloud scanning
  2. On-premises management server hosted in the customer data center Correct answer.
  3. Console-only administration without a server
  4. Cloud-hosted management in the vendor region

Explanation

Hosting the management server on-premises keeps endpoint security data inside the customer's own data center, meeting data-residency requirements. Cloud-hosted options move that data outside the customer's control.

Question 19Harmony Endpoint deployment and architecture

Which statement accurately distinguishes the management server from the endpoint client in Harmony Endpoint?

  1. The server enforces policy; the client stores it only
  2. Both perform identical functions on the same host
  3. The server defines and distributes policy; the client enforces it on the host Correct answer.
  4. The client distributes policy to other clients

Explanation

Harmony Endpoint separates administration from enforcement: the management server defines and distributes policy, while the client enforces it locally. This division is central to the architecture.

Question 20Harmony Endpoint deployment and architecture

An endpoint reports it cannot download updates. Which architectural dependency should the administrator check first?

  1. The number of local user accounts
  2. The endpoint's screen brightness
  3. The endpoint's keyboard layout
  4. Connectivity from the endpoint to the update source permitted by policy and firewall Correct answer.

Explanation

Update failures usually trace to blocked connectivity between the endpoint and its update source, whether that is the management server or a vendor update service. Peripheral and cosmetic settings do not affect update delivery.

Question 21Harmony Endpoint deployment and architecture

A large enterprise wants to phase a policy change across 10,000 endpoints while monitoring impact. Which deployment strategy best fits Harmony Endpoint capabilities?

  1. Pilot on a small group, verify results, then expand assignment group by group Correct answer.
  2. Reinstall every client before any policy change
  3. Suspend management for the estate during the change
  4. Apply the change to all endpoints simultaneously with no monitoring

Explanation

Phased rollout using groups lets the team validate the change on a pilot before expanding, limiting blast radius and allowing monitoring at each stage. Simultaneous changes or reinstalls increase risk without added control.

Question 22Harmony Endpoint deployment and architecture

An administrator must ensure that endpoints in a high-security zone cannot communicate with the management server over unencrypted channels. Which architectural control addresses this?

  1. Place the endpoints in the default group
  2. Disable logging on those endpoints
  3. Remove the endpoints from all policies
  4. Enforce encrypted communication between clients and the management server Correct answer.

Explanation

Requiring encrypted communication between clients and the server protects policy and event data in transit. Removing endpoints from management or disabling logging reduces security rather than strengthening the channel.

Question 23Harmony Endpoint deployment and architecture

A company must prove to auditors that endpoints are consistently protected under a documented baseline. Which Harmony Endpoint design element most directly supports this?

  1. Allowing endpoints to remain unmanaged
  2. A defined baseline policy assigned to all endpoint groups with reporting on compliance Correct answer.
  3. Individual users choosing their own protection settings
  4. Disabling the console audit trail

Explanation

A documented baseline policy applied across groups, combined with console reporting, demonstrates consistent enforcement for auditors. Letting users self-configure or leaving endpoints unmanaged undermines provable consistency.

Question 24Harmony Endpoint deployment and architecture

When planning a multi-site Harmony Endpoint deployment, why is it important to map which endpoints can reach which management server address?

  1. Endpoints must share a single public IP address
  2. Clients must be able to resolve and reach their assigned server for policy and updates Correct answer.
  3. The console requires each endpoint to have a unique wallpaper
  4. Each site must run its own ThreatCloud instance

Explanation

Clients depend on reaching their assigned management server to receive policy and updates, so address resolution and reachability must be planned per site. Wallpaper, shared public IPs, and per-site ThreatCloud instances are not architectural requirements.

Question 25Harmony Endpoint deployment and architecture

An administrator discovers that a group of endpoints is enforcing an outdated policy despite recent server changes. Which explanation is most plausible within the Harmony Endpoint architecture?

  1. The console session has timed out
  2. The endpoints have too many installed fonts
  3. Those clients have not yet synchronized with the management server Correct answer.
  4. The endpoints use wireless keyboards

Explanation

Clients apply policy after synchronizing with the management server; if synchronization has not occurred, they continue enforcing the previously received policy. Peripheral details and console session state do not affect policy on the host.

Question 26Harmony Endpoint deployment and architecture

In a Harmony Endpoint deployment, which component is responsible for enforcing the security policy on the endpoint itself, including file scanning and behavioral protection?

  1. The logging database tier
  2. The endpoint client agent installed on the managed device Correct answer.
  3. The management server that stores policies
  4. The license management portal

Explanation

The endpoint client agent is the enforcement point: it receives policy from the management server and applies protection locally, including static and behavioral inspection even when disconnected. The management server distributes configuration and collects status but does not perform scanning on the device.

Question 27Harmony Endpoint deployment and architecture

Which statement best describes the role of the policy layer in Harmony Endpoint architecture?

  1. It is the update distribution service that delivers signature packages only.
  2. It is the reporting engine that generates compliance dashboards for auditors.
  3. It defines the protection settings and rules that assigned endpoint clients download and enforce. Correct answer.
  4. It provides the cryptographic keys used to encrypt endpoint disk volumes.

Explanation

Policy in Harmony Endpoint is a configuration object that groups protection settings, and it is assigned to endpoints or groups so the client can download and enforce it. It is distinct from update distribution, encryption key handling, and reporting, which are separate functions.

Question 28Harmony Endpoint deployment and architecture

An organization is planning a Harmony Endpoint rollout and wants endpoints to obtain policy and send status without exposing the management server directly to inbound internet connections. Which design element addresses this requirement?

  1. Disabling policy download so clients use built-in defaults
  2. Assigning each endpoint a static public IP address
  3. A second management server deployed in each branch office
  4. A reverse proxy or gateway placed in front of the management server to broker client connections Correct answer.

Explanation

Placing a reverse proxy or gateway in front of the management server lets endpoints reach it while the server itself stays shielded from direct inbound exposure. This is a common pattern for internet-facing deployments and preserves centralized management.

Question 29Harmony Endpoint deployment and architecture

Which Harmony Endpoint architectural element determines whether an endpoint is allowed to connect and receive policy based on its assigned license?

  1. The endpoint's operating system build number
  2. The license entitlement associated with the endpoint and its assigned package Correct answer.
  3. The geographic region configured on the endpoint
  4. The number of CPUs on the management server

Explanation

Entitlement is driven by the license attached to the endpoint and the package it is assigned, which determines which protections the client may activate. OS build, region, and server CPU count do not gate policy delivery by license.

Question 30Harmony Endpoint deployment and architecture

A security architect wants endpoint protection to continue functioning when the management server is unreachable for an extended period. Which design property of Harmony Endpoint supports this?

  1. The management server pushes policy only when a user logs on interactively.
  2. Protection is suspended until connectivity is restored.
  3. Endpoints poll the license portal for enforcement decisions.
  4. The endpoint client enforces its last downloaded policy locally and caches protection state. Correct answer.

Explanation

Harmony Endpoint clients store the last applied policy and continue enforcing it while offline, so protection is not dependent on continuous server reachability. This offline resilience is a core architectural property for laptops and remote sites.

Question 31Harmony Endpoint deployment and architecture

When sizing a Harmony Endpoint management server, which input most directly drives capacity requirements?

  1. The number of policy packages defined in the console
  2. The physical rack units available in the data center
  3. The number of administrators who log in per month
  4. The number of managed endpoints and the volume of events they report Correct answer.

Explanation

Server sizing is driven primarily by the count of managed endpoints and the event/log throughput they generate, since these determine database and processing load. Administrator logins, rack space, and policy package counts are comparatively minor factors.

Question 32Harmony Endpoint deployment and architecture

An administrator wants a subset of endpoints to receive a different protection configuration than the rest of the estate while keeping a single management server. Which Harmony Endpoint construct is designed for this?

  1. Assigning endpoints to a group and attaching a distinct policy to that group Correct answer.
  2. Editing the global default policy and reverting it later
  3. Removing the subset from management temporarily
  4. Deploying a separate management server for the subset

Explanation

Groups in Harmony Endpoint allow a subset of endpoints to be associated with a specific policy while other endpoints keep their own assignments, all under one server. This provides scoped configuration without additional infrastructure.

Question 33Harmony Endpoint deployment and architecture

Which statement correctly distinguishes the management server from the endpoint client in a Harmony Endpoint deployment?

  1. The client hosts the policy repository, while the server enforces rules.
  2. The server centralizes policy, distribution, and status collection, while the client performs local enforcement. Correct answer.
  3. The server performs file scanning, while the client only stores logs.
  4. Both components perform identical functions and differ only in licensing.

Explanation

The management server is the control plane: it stores policy, distributes updates, and aggregates status. The endpoint client is the data plane on the device, enforcing protection and reporting results back.

Question 34Harmony Endpoint deployment and architecture

An endpoint reports that it cannot retrieve updated protection content. Which architectural dependency should the administrator verify first?

  1. The CPU utilization of the administrator workstation
  2. Connectivity from the endpoint to the update distribution source configured for the deployment Correct answer.
  3. The expiration date of the endpoint's disk encryption key
  4. The number of policy packages defined in the console

Explanation

Content updates depend on the endpoint reaching the configured update source, whether that is the management server or a designated distributor. Verifying that communication path is the first diagnostic step before examining unrelated configuration.

Question 35Harmony Endpoint deployment and architecture

A multi-site organization must decide how endpoints in each region reach the Harmony Endpoint management infrastructure. Why is mapping endpoint-to-server reachability important during planning?

  1. It defines the number of licenses consumed per site.
  2. It sets the encryption algorithm used for disk volumes.
  3. It determines whether endpoints can register and receive policy across firewalls and NAT boundaries. Correct answer.
  4. It controls the retention period for audit logs.

Explanation

Endpoints must be able to reach a management server or designated distribution point through intervening firewalls and NAT devices to register and pull policy. Mapping reachability exposes gaps that would otherwise leave endpoints unmanaged.

Question 36Harmony Endpoint deployment and architecture

What is the primary purpose of registering an endpoint with the Harmony Endpoint management server?

  1. To permanently bind the endpoint to a single physical network
  2. To disable local logging on the endpoint
  3. To transfer ownership of the device to the vendor
  4. To establish the managed relationship so the endpoint can receive policy and report status Correct answer.

Explanation

Registration creates the managed relationship between client and server, enabling policy delivery and status reporting. It does not alter device ownership or restrict the endpoint to a fixed network.

Question 37Harmony Endpoint deployment and architecture

An administrator finds that endpoints in a high-security zone must not communicate with the management server over unencrypted channels. Which architectural control satisfies this requirement?

  1. Disabling policy download for that zone
  2. Moving the management server into the same zone without transport controls
  3. Enforcing encrypted transport between endpoint clients and the management server Correct answer.
  4. Relying on the endpoint's local firewall only

Explanation

Requiring encrypted transport between clients and the server protects policy and telemetry in transit, satisfying the zone's security mandate. Co-location alone does not guarantee encryption, and disabling policy download would leave endpoints unmanaged.

Question 38Harmony Endpoint deployment and architecture

Which Harmony Endpoint capability allows an organization to demonstrate that endpoints conform to a documented protection baseline?

  1. Policy compliance status reported from managed endpoints to the console Correct answer.
  2. Manual screenshots collected by administrators
  3. License invoices retained by procurement
  4. Endpoint hostnames recorded in a spreadsheet

Explanation

Managed endpoints report their compliance with assigned policy to the console, giving auditors evidence of consistent enforcement. Manual collection methods are not reliable or scalable for demonstrating baseline conformance.

Question 39Harmony Endpoint deployment and architecture

An administrator observes that a group of endpoints is enforcing an older policy despite recent changes on the server. Which architectural explanation is most consistent with this observation?

  1. The management server has too many administrators
  2. The endpoints have not yet synchronized with the server to download the updated policy Correct answer.
  3. The endpoints have exceeded their license count
  4. The endpoints are using a different operating system

Explanation

Clients apply policy after synchronizing with the server, so endpoints that have not yet connected continue enforcing the previously downloaded version. License count, administrator numbers, and OS differences do not explain stale policy enforcement.

Question 40Harmony Endpoint deployment and architecture

In a Harmony Endpoint architecture, what is the function of a distribution point separate from the primary management server?

  1. It stores license keys for the organization
  2. It performs endpoint disk encryption key escrow
  3. It serves content and updates to endpoints, reducing load and WAN traffic on the primary server Correct answer.
  4. It replaces the management server for policy authoring

Explanation

A separate distribution point offloads content and update delivery so endpoints at remote sites do not all pull from the primary server, reducing WAN utilization and server load. Policy authoring and license handling remain with their dedicated components.

Question 41Endpoint security policy management

In Harmony Endpoint, a policy rule's action is set to Prevent on a file threat. What is the primary effect when a user attempts to open a file matching that rule?

  1. The file is encrypted until an administrator releases it.
  2. The file is quarantined and the user is blocked from accessing it. Correct answer.
  3. The file is sent to the management server for manual approval.
  4. The file is logged and the user is allowed to open it.

Explanation

A Prevent action blocks the operation and typically quarantines the offending file so it cannot be executed or opened. Log-only behavior belongs to Detect actions, not Prevent. Quarantine storage and remediation are handled by the endpoint agent under policy control.

Question 42Endpoint security policy management

Which Harmony Endpoint component enforces the policy on the endpoint device itself?

  1. The management server
  2. The endpoint security agent Correct answer.
  3. The policy deployment console
  4. The cloud reputation service

Explanation

The endpoint agent is the client software installed on the device that receives and enforces policy locally. The management server stores and distributes policy but does not enforce on the device. Reputation services provide intelligence, not local enforcement.

Question 43Endpoint security policy management

An administrator wants a rule to apply only to endpoints in the Finance organizational unit. Which policy assignment mechanism should be used?

  1. A rule with the action set to Ask
  2. A rule scoped to the Finance OU Correct answer.
  3. A global rule with no scope
  4. A default rule placed at the top of the rulebase

Explanation

Policy rules in Harmony Endpoint are assigned by scope, such as organizational units, so a rule scoped to Finance applies only to those endpoints. Global rules apply broadly, and rule order or action does not restrict targeting. Scoping is the mechanism that limits which endpoints receive a rule.

Question 44Endpoint security policy management

What is the purpose of the policy installation operation in Harmony Endpoint?

  1. To update the agent's operating system
  2. To push the current policy to the assigned endpoints Correct answer.
  3. To generate compliance reports
  4. To back up the management database

Explanation

Installing policy delivers the current rulebase to the endpoints in scope so the agent can enforce it. Without installation, changes made in the console remain on the server. Backups, OS updates, and reporting are separate functions.

Question 45Endpoint security policy management

A rule uses the Ask action for removable media access. What happens when a user inserts a USB drive?

  1. Access is silently allowed and logged.
  2. The drive is formatted automatically.
  3. The user is prompted to allow or block the access. Correct answer.
  4. Access is silently blocked.

Explanation

The Ask action presents a prompt to the user, who decides whether to permit the access at that moment. Silent allow and silent block correspond to other actions. Formatting media is never an automatic policy outcome.

Question 46Endpoint security policy management

Which setting determines whether the Harmony Endpoint agent reports detected events to the management server?

  1. The reputation service cache size
  2. The agent's logging and reporting configuration in the policy Correct answer.
  3. The operating system event viewer retention
  4. The endpoint's local firewall profile

Explanation

Logging and reporting settings in the policy control whether the agent forwards events to the management server. Local firewall profiles and OS event retention affect other functions. Reputation cache size does not govern event reporting.

Question 47Endpoint security policy management

What does the term rulebase order refer to in Harmony Endpoint policy?

  1. The alphabetical sorting of rule names
  2. The order in which endpoints are enrolled
  3. The sequence in which rules are evaluated for a given event Correct answer.
  4. The order of columns in the log view

Explanation

Rulebase order is the evaluation sequence; the first matching rule for an event typically determines the outcome. Rule names, enrollment order, and log columns do not control enforcement. Understanding order is essential to predict which action wins.

Question 48Endpoint security policy management

Which Harmony Endpoint capability inspects files for known malware signatures on the endpoint?

  1. Anti-Malware Correct answer.
  2. Anti-Bot
  3. Media Encryption
  4. Anti-Phishing

Explanation

Anti-Malware performs signature-based and behavioral malware detection on the endpoint. Anti-Bot targets command-and-control traffic, Anti-Phishing targets credential theft sites, and Media Encryption protects removable media data. Each blade addresses a distinct threat class.

Question 49Endpoint security policy management

An administrator needs to exempt a trusted internal application server from a behavioral rule without disabling the rule globally. Which approach is most appropriate?

  1. Lower the rule's severity to Informational
  2. Move the rule to the bottom of the rulebase
  3. Create an exclusion scoped to that server Correct answer.
  4. Disable the entire blade for all endpoints

Explanation

A scoped exclusion removes the specific server from the rule's effect while leaving protection active elsewhere. Disabling the blade removes protection globally, and severity or ordering changes do not exempt a single host. Exclusions are the targeted mechanism for trusted exceptions.

Question 50Endpoint security policy management

Two rules match the same file event: an Allow rule placed above a Block rule. What is the expected enforcement outcome given typical first-match evaluation?

  1. The Allow rule wins because it is evaluated first. Correct answer.
  2. The Block rule wins because blocking takes precedence.
  3. The agent prompts the user to choose.
  4. Both actions are applied and the file is partially blocked.

Explanation

In a first-match rulebase, the earliest matching rule determines the action, so the Allow rule wins. Blocking does not automatically override earlier rules. A single action is applied per event; conflicting partial enforcement does not occur.