Checkpoint CCES 156-536 Question # 20 Topic 3 Discussion

Harmony Endpoint offers advanced post-infection capabilities to analyze and mitigate threats after they occur. These features are detailed in theCP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdfunder its threat prevention sections.

Onpage 346, under "Forensics," the guide states:

"Forensics provides automated attack analysis, helping to understand the nature and impact of threats."

Onpage 336, under "Quarantine Settings and Attack Remediation," it notes:

"Quarantine Settings and Attack Remediation allow for isolating infected files and systems."

Additionally, onpage 329, under "Harmony Endpoint Anti-Ransomware, Behavioral Guard and Forensics," it mentions:

"Analyzes incidents reported by other components."

These extracts collectively confirm that Harmony Endpoint includes:

Automated Attack Analysis (Forensics)– Automatically analyzing threats post-infection.

Remediation and Response– Addressing and repairing the damage (implied in attack remediation).

Quarantine– Isolating infected elements to prevent further spread.

This matchesOption Bperfectly.

Evaluating the other options:

Option A: IPS Attack Analysis (Forensics), Deploy and Destroy, and Isolation– "IPS" is a network feature, not endpoint-specific, and "Deploy and Destroy" is not a documented term.

Option C: FW Attack Analysis (Forensics), Detect and Prevent, and Isolation– "FW" (Firewall) is unrelated to endpoint post-infection, and "Detect and Prevent" are pre-infection actions.

Option D: IPS Attack Analysis (Forensics), Detect and Prevent, and Isolation– Again, "IPS" is incorrect, and "Detect and Prevent" is not post-infection-focused.

Option Baccurately represents Harmony Endpoint’s post-infection capabilities as per the documentation.