CCES (Harmony Endpoint Specialist) study plan
CCES (Harmony Endpoint Specialist) · Give each week a clear focus.
8 weeks · About 7 hours per week
Harmony Endpoint deployment and architecture
Diagram the Harmony Endpoint management chain from the management server through the endpoint client, labeling which component stores policy, which distributes it, and which enforces it.
Explain how policy distribution works, including what triggers an endpoint to pull updated policy and what happens when the endpoint cannot reach the management server.
List the supported deployment models (on-premises management, cloud-hosted management) and state one operational tradeoff for each.
Identify the endpoint client's core services and describe what breaks when each is stopped or blocked by a host firewall.
Your checkpoint
A one-page architecture diagram with a written legend explaining each component and the policy flow between them, plus a table of deployment models and tradeoffs.
Harmony Endpoint deployment and architecture & Endpoint security policy management
Map each major policy blade in the management console to the endpoint behavior it controls, so you can name the blade responsible for a given symptom.
Describe how policy assignment works across organizational units or groups, and predict which policy applies when an endpoint matches multiple assignments.
Walk through creating a baseline policy from scratch and justify each non-default setting you choose.
Explain how to stage a policy change so it is tested on a pilot group before broad rollout.
Your checkpoint
A baseline policy specification document listing every blade, the chosen setting, and a one-line justification, plus a pilot-rollout procedure.
Endpoint security policy management
Configure exception and exclusion rules for files, folders, processes, and signatures, and describe the security risk each exclusion introduces.
Design a rule that blocks a category of untrusted application while allowing a business-critical signed application of the same type.
Explain how device control and removable-media policy is scoped and how to audit what was blocked.
Compare enforcement versus detect-only modes for each major blade and state when each is appropriate.
Your checkpoint
An exception register with at least eight entries, each with purpose, scope, risk rating, owner, and review date.
Threat prevention and anti-malware configuration
Describe the anti-malware scanning pipeline, including on-access versus on-demand scanning and what each engine or signature set contributes.
Configure behavioral protection and ransomware protection settings and explain which attack techniques each is designed to stop.
Explain how to tune a blade that is generating false positives without disabling the protection entirely.
Trace a malware detection from the endpoint event through to the management console record.
Your checkpoint
A threat-prevention configuration worksheet covering anti-malware, behavioral, and ransomware settings with the rationale and expected false-positive risk for each.
Threat prevention and anti-malware configuration & Forensics, incident response, and remediation
Build a response runbook for a confirmed infection that covers isolation, evidence capture, eradication, and return to service.
Explain what forensic artifacts the endpoint client records and where an analyst retrieves them from the management console.
Describe how to quarantine and restore a file safely, including the checks performed before restoration.
Distinguish a true positive from a false positive using the event details available in the console.
Your checkpoint
A complete incident-response runbook with numbered steps, decision points, and the console screens or logs used at each step.
Forensics, incident response, and remediation
Perform a threat-hunting exercise using console search and filtering to find endpoints with a specific suspicious indicator.
Explain how to collect and interpret endpoint forensic data for a host you suspect is compromised but not yet flagged.
Design a remediation action plan for an endpoint that cannot be cleaned in place, including reimaging and re-enrollment steps.
Document the chain of custody considerations for evidence gathered from an endpoint.
Your checkpoint
A threat-hunt report describing the hypothesis, the queries run, the findings, and the recommended remediation for each affected host.
Monitoring, reporting, and troubleshooting
Interpret the main console dashboards and explain which operational question each one answers.
Configure a scheduled report and an alert for a condition that matters operationally, such as a spike in blocked threats or endpoints out of compliance.
Diagnose the top five common endpoint-to-management connectivity failures using logs and status indicators.
Explain how to verify that a policy change actually reached the endpoints it targeted.
Your checkpoint
A monitoring pack containing one configured alert, one scheduled report definition, and a troubleshooting decision tree for connectivity failures.
Harmony Endpoint deployment and architecture & Endpoint security policy management & Threat prevention and anti-malware configuration & Forensics, incident response, and remediation & Monitoring, reporting, and troubleshooting
Re-run a timed mixed-domain practice set and score each domain separately to expose remaining weak areas.
Re-teach your two weakest domains from your own notes without consulting documentation, then correct the gaps.
Summarize each domain's key facts on a single reference sheet you can review in the final days.
Confirm you can state the correct console location or workflow for the twenty most commonly tested operations.
Your checkpoint
A personal one-page-per-domain cheat sheet plus a scored practice-set log showing improvement over your week-4 baseline.
Milestones
Week 2: You can draw the full architecture from memory and correctly name the policy blade responsible for any given endpoint symptom in under two minutes.
Week 4: You score at least 70% on a mixed practice set covering domains 1-3, with no single domain below 60%.
Week 6: You complete the incident-response runbook end to end against a simulated infection scenario without consulting reference material.
Week 8: You score at least 80% overall on a full-length mixed practice set, with every domain at or above 70%.