Endpoint security policy management
This domain tests how Harmony Endpoint policy is assembled, assigned, overridden, and pushed. Questions focus on the difference between a profile and a rule, how exceptions interact with blade settings, and why a saved change is not necessarily an enforced change.
Policy building blocks
- Each Software Blade has its own rules or settings. A Policy Profile bundles those settings for a group of endpoints.
- Profiles are assigned by user, group, organizational unit, or individual endpoint. A default profile may cover everything not explicitly assigned.
- Exceptions are scoped overrides. They can be global or profile-level, and they can exclude files, folders, processes, or trusted applications from a blade.
- Firewall and Application Control rules are evaluated in order, so a broad allow above a specific block changes the outcome.
- Changing a profile or rule does not enforce it on endpoints until Install Policy succeeds.
Precedence and scope
Think in this order: which profile applies, which blade setting is active, which exception matches, and whether the action is allowed or blocked. Exceptions are powerful because they bypass the normal blade action for matching traffic or files. Trusted applications should be identified by signer or hash, not by a user-writable path.
Worked example
Finance must block USB storage but allow one signed backup utility. Create a profile with Media Encryption and Port Protection blocking storage devices, then add a narrowly scoped exception for the backup utility's signer or hash. Assign the profile to the Finance AD group, deploy to a Finance pilot machine, confirm the block and the exception, then install policy to the full group. Reasoning: the profile enforces the control, the exception preserves the business tool, and the pilot proves both behaviors before broad rollout.
Traps
- Editing the default profile when only one department should change; the default may affect many endpoints.
- Creating an exception on a whole drive or a user-writable folder, which silently disables protection.
- Assuming a saved policy is active before installation status shows success.
- Trusting an application by path when a hash or signer is available.
- Adding a user to an AD group but not refreshing or reassigning policy scope.
- Stacking overlapping rules and assuming the most specific one wins automatically.