Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Check Point > CCES > Flashcards

CCES Flashcards

1
Q

SmartEndpoint Combines what elements into package

A

Data
Network
Remote Access
Threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

SmartEndpoint Allows access control over

A

Company data
Attacks
Zero Day threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Admins can perform what tasks in SmartEndpoint

A
  • Centrally monitor, manage, and enforce user and machine based company policy
  • Quickly deploy protections for users
  • customize policies
  • Monitor end user devices for malicious software
  • Control access to corporate data and apps
  • Protect sensitive data from virus and threats on the web and in attachements
  • perform risk assessment to ensure compliance
  • inform and remediate attacks on end user machines
  • view and report security events
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How does SmartEndpoint communicate with SmartEndpoint management server

A

SIC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How does the endpoint security management server communicate to clients.

A

Http/Https

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

main components of a SmartEndpoint deployment

A
  1. SmartEndpoint
  2. Endpoint management server
  3. Endpoint clients
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Endpoint security database houses

A 
Policy
User and computer data
Mgmt data
Licenses
Ad node objects
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the default communication interval between client and mgmt server

A

60 seconds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What 2 components make up the endpoint agent

A

Agent

DA Framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the activities performed by endpoint client

A

Communication
Deployment
EMON state info
Updating files and Drivers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does the DA framework do?

A

Policy activation / updating

Log collection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What functions does the SmartEndpoint management interface

A

Deployment
Monitoring
Configuration endpoint clients
Manage policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the 3 main components of an Endpoint security environment?

A
  1. Endpoint management server
  2. SmartEndpoint
  3. Endpoint Clients
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How does the security management server work in the environment

A

Endpoint SMS contains security software and database

The server communicates with the endpoint to manage policies and update protections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

SmartEndpoint Management has 5 tabs, what are they?

A 
Overview
Policy
User and Computers
Reporting
Deployment
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The deployment tab shows what information

A

Security Summary
Active Alerts (10 Minute Update)
Security Status

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

The policy tab shows

A

Collection of security rules. This includes the default rules (cannot be deleted)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

The users and computers tab shows

A

Hierarchical Tree of organization

Review of the status of the current blade

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

The reports tabs shows?

A

Pre-defined reports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

The deployment tab shows?

A

Create deployment rules and manage packages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What does endpoint firewall blade do?

A

Controls inbound and outbound traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What does the URL filtering blade do

A

Limits and blocks access to websites by

  • category
  • user
  • group
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What’s does the Anti-Malware blade do?

A

Signature base for (scans all files accessed)
Viruses
Spyware
Trojans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What does the data security blades do?

A
  1. Capsule docs: Protects, track and restricts access to buisness doc
  2. FDE Encrypt Storage and provides access protection (pre-boot protection)
  3. Media & Port Protection: Strong encryption USB, CD/DVD/SD
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What does the sandblast agent do?

A

Zero Day:
Anti-bot
Ransomware
Threat Extraction & Threat Emulation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the 3 licenses required for endpoint deployment

A
  1. Mgmt
  2. Container
  3. Software blade
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What features does the management license components

A

Policy management
Logging & status
User directory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Container license components

A

FW
Appctl
Compliance (annual or perpetual)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Do you have to license each blade that you want to provide to a client

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What places can you add/remove licenses

A
  1. Smart update
  2. Gai
  3. Colic
  4. Cpconfig
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

How do you recoup licenses from stale machines

A

Delete the client computers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are the 5 areas of the users and computers tab

A
  1. All organization folder
  2. Global Action folder
  3. Favorites
  4. Blades Status
  5. Rule and status pane
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What populates the directories node

A

After the initial AD scan

**objects can be part of AD and the virtual groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Where are objects that are not part of AD places

A

Others users & computers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

How do you manage users

A

Select from the tree, and then add blades and follow steps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Can anyone log into a computer with endpoint

A

No only authorized pre-boot users can log into machines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What happens when you reset a client

A

Removes license
Deletes settings
FDE and Recovery are removed
**must be reformatted before can connect machine back to endpoint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Where can push operations be accomplished from

A

Reporting

Global Actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What things can be accomplished through push operations

A 
Anti-malware scans
Anti-malware updates
Restore Files
Sandblast forensics and analysis 
Restart /shutdown
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Where is the initial client exported from in the console

A

Deployment tab

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What does the initial client do?

A

Provides communication
Deployment
Client state
Policy and client status updates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Types of blade packages:

A

Master full- all blades
Master full without network protection: FDE & MEPP only
Master SBA: Sandblast with FW, Compliance, App protection
NEWDA: 32 bit initial client without blades (cannot be distributed via deployment rule)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

How many packages are created when a new package created

A
  1. Desktop
  2. Laptop
    * *done as laptops often have stricter policies
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Does client install interfere with normal user operation

A

No

**FDE is an exception as might require reboot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What tab allows you to modify or upgrade protections

A

Policy tab

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Two methods of mod or upgrade

A

Deployment Rules or Exported package

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

how do you get new version into mgmt server

A
  1. Download

2. Upload

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Does the client and blade package need to be upgraded at the same time.

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

How would you allow postpone of client upgrade

A

Client settings allow postpone upgrade

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Deployment rules characteristics

A
  1. Automatically download and install preconfigured client packages
  2. Deploy to individual or all nodes
  3. Policy needs to be installed for rules to apply
  4. Must do initial install before blade deployment
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

User Authentication settings are done in what tab in the console?

A

Reporting tab

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What are the predefined actions in OneCheck

A
  1. User predefined windows recommended password complexity
  2. Pre-boot password updates
  3. Temp lock failed attempts
  4. Use default login settings
  5. Allow remote help
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What is pre-boot

A

User must login before the OS boots

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What are the pre-boot authentication options

A
  1. Passwords
  2. Smart cards
  3. Dynamic tokens
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Why use FDE

A

When machines are shared amongst users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

How and what type of encryption FDE

A

AES, HDD is encrypted, but data is not.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What feature is used for FDE authentication

A

OneCheck Logon policies manage FDE user logins and password security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

When using AD recommended to use which authentication components

A

User Acquisition
OneCheck Logon
Password Sync (same creeds SSO login)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Is user acquisition enable by default for FDE

A

Yes

***Requires users log in and out to acquire pre-boot credentials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

OneCheck Logon

A

SSO solution VPN and FDE password Sync

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Password Sync

A

Pre-boot prevents OS from booting until user authenticated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Can passwords be changed at preboot.

A

Yes, and it automatically sent to all computers the user is authorized to access pre-boot.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Endpoint had monitoring built-in for what?

A

Connection State:Compliance:other data connected clients
Provide system-wide reporting or granular user and computers
monitoring reports for compliance, activity, software, deployments…etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Name the 5 tabs in the SmartEndpoint GUI

A
  1. Overview
  2. Policy
  3. Users & computers
  4. Reporting
  5. Deployement
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What are blades included in the data protections for endpoint

A

FDE, MEEP, Capsule docs, VPN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What licenses are required for endpoint security

A

Mgmt
Blades
Container

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Where are endpoint historic logs kept

A

Smart console

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What do OneCheck users settings define

A

How users authenticate to endpoint security. More specifically, how a user log into his/her computer and what happens with failed attempts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

ESM Components

A 
SmartEndpoint
ESM blade
Endpoint blades
Endpoint DB
Directory Scanner
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Installation methods for ESM

A
  1. Standalone- with the network management server

2. Distributed - Helps ensures no hotfix upgrades

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Things to watch out for during instalation

A

1: Network Security management and smart console must be installed
2: Ad structure can be replicated into EMD DB
3: Ad scanner will require AF permission to read only

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

What port handles loop back for Mgmt and AD scanner comes

A

8080

73
Q

What port encrypted client comes to client sever, FDE, and MEPP

A

443

74
Q

What is -port is SIC communications

A

18190

75
Q

Which port handles SSL Gaia portal

A

4434

76
Q

What port handles SOC proxy198

A

1080

77
Q

What SK# provides all port access requirements

A

SK52421

78
Q

What component is required to incorporate AD users, computers

A

AD Scanner

79
Q

What type of information is captured by AD scanner

A
  1. OU’s
  2. Users (not contacts)
  3. Computers
  4. Security group
80
Q

What is polling intervals for AD scanner

A

2 minute management server

AD refresh every 5 minutes`

81
Q

How many scanners is recommended per domain

A

One, be sure not to duplicate scan networks

82
Q

What are the four type of client deployment and installation

A
  1. Automatic deployment rules
  2. Package export and manual install
  3. CLI
  4. Third part tools (SCCM, GPO
83
Q

What are the steps for client install in an automatic deployment

A
  1. Automatic =Manual install initial client and then deployment rules

**deployment log %programdata%\checkpoint\Endpoint Security

84
Q

How do you install the endpoint client manually

A

Export package (via third party, file share, email), use the deployment tab;
Create/change deployment tab>packages for export
Run as administrator EPI.MSI
CLI msiexec /i EPS.msi

Install log %temp%\MSIXXXX.log

85
Q

How do you uninstall endpoint client

A

Same as all other windows programs, but need admin access **make sure to remove from console after you are completed to free up licenses

86
Q

How do you install endpoint client on the Mac

A

Manual only way possible install, expand *.zip file and start the install

87
Q

What common third party tool most commonly used to install client in a windows env

A

SCCM/GPO

88
Q

What type of information is in the endpoint client GUI

A
  1. Overview of protections on machine
  2. Client update status and scan info
  3. Allow users to request updates and view scans
    4 Policies and log info on the advanced tab
89
Q

Client Settings Policy does what?

A 
Default settings for entire org, for the below settings
A. General UI settings
B. Log & alert confirms
C. Install and upgrade settings
D. Network protections
E. Local deployment optons
F. Data  sharing options
90
Q

What type of remote connection options (VPN) are available

A

IPSEC
SSL VPN
Mobile access

91
Q

Where does VPN license reside

A

Network management server

92
Q

What do access zoned do?

A

They define trusted and untrusted networks

93
Q

Where can VPN settings be defined

A
  1. Compliance policy

2. Advanced Deployment options (This is where sites created)

94
Q

Are VPN settings part of the automatic client deployment

A

No

95
Q

You can have compliance checks run before an individual can access VPN. What two types of policy checking can be defined

A

Endpoint security compliance= use endpoint security policy

VPN SCV compliance= this forces security compliance with org policies

96
Q

What is the client authentication process for?

A

Process of identifying client machine and the person working on it.
2 modes
Authenticated ( recommend live env)
Unauthenticated (insecure used IP and should be used in a lab)

97
Q

How do you enable strong authentication

A

Based on Kerberos, user must be in AD

**Need to run it ktpass.exe, created key tab file> this will then be used to setup authentication connection type

98
Q

Where are client logs stored

A

On the endpoint device

99
Q

What type of security is used between the management server

A

TlSv1 & TLSvv2 certificate based key

100
Q

What type of communication between the endpoint security server and other CP products

A

SIC + Certificate

101
Q

When does a client check for updated

A

Startup
Heartbeat Response
Client Component Changes
Installation state changes

102
Q

What is the AD scanner and how does it work

A

Scans AD and copies org chart into endpoint

103
Q

What are the four ways to install endpoint

A
  1. Automatic
  2. Manual
  3. CLI
  4. Third Party
104
Q

What are the two VPN Client authentication actions Which can be enforced when verification fails

A

Endpoint Security Compliance

VPN SCV Compliance

105
Q

How do Endpoint Security Server communicate with other CP servers

A

SIC + Certificates

106
Q

What does the policy server Do?

A

Houses log server
Manages client communication
Improves performance (decreases load on ESM)

107
Q

How many policy servers should you have in each remote site

A

One

108
Q

What are steps in installing log server

A
  1. Create new object in smart dashboard
  2. Enable EPM, Logging and status blades on the object
  3. Push policy and install database
  4. Then add the new policy server menu, management, endpoint servers new
109
Q

What type of communication does policy server respond to

A

Heartbeat
Sync
Policy downloads
Malware Updates

**Client will connect to the server that is closest. So if policy server and management server client will choose.

110
Q

How can you tell which policy server client is connected

A

Run activity report and will tell you which server the client is connected

111
Q

When does new policy server sync

A

Initial sync is done after configured and installed

Then heartbeat will keep sync after first

112
Q

How many standby management servers are allowed

A

One

113
Q

Steps to create HA management server

A 
Install new SMS server
Enable network policy management 
Establish SIC primary EMS and standby
Install DB on secondary
Wait for sync
Enable endpoint management on second management 
Install DB
114
Q

When failing over to secondary EMS management, is it automatic

A

No

115
Q

What two manual activities are required on secondary EMS

A
  1. packages

2. Failover

116
Q

When does the initial sync occur between primary and standby management servers

A

After the policy server is configured and policy is installed

117
Q

What type of data security can endpoint client provide

A

In transit
At rest
In use
Shared

118
Q

What data security solutions are provided by the endpoint system

A
  1. FDE
  2. MEPP
  3. Capsule docs
  4. VPN
119
Q

Features of FDE

A

Data at rest
Protects user data, OS file, temp and erased file
Combines OS boot protection with preboot auth

120
Q

Features of MEPP

A

Data at rest
Controls and logs all endpoint port activity
Manages ports by blocking certain ports based on policy

121
Q

Capsule Docs features

A

Data in-use /shared
Allows access and share corp docs
Integrates with windows client
Audit trail in smartview tracker

122
Q

Remote Access VPN features

A

Transit, rest, in-use, and share

123
Q

FDE Disk Encryption

A

To initiated requires user authentication

Process runs in the background

124
Q

What type of encryption is default and available for FDE

A 
AES 256 (default)
3DES 168
Blowfish 255 
Cast 128
XTS AES 128 & 256 EFI
125
Q

Why is FDE pre-boot important

A

Avoids unauthorized access to disk by removing third part tools
Ensures user identity prior to booting into data drive
Supports multi-factor

126
Q

What are the FDE file components

A 
FDE Service (FDE_SRV.exe)- config, encrypt and handles policy
Crypto Core (CCore32.bin)- encryption algorithms 
Filter Driver (prot_2k.sys) Driver for encryption FAT drives sector location
127
Q

Gotchas for FDE

A

Need 32mb contiguous space no Raid
no hybrid drive with cache / compressed root file system
By default encrypts all visible drives

128
Q

How to start encrypting with FDE

A
  1. Connect machine to management
  2. Download FDE policy
  3. Run through user acquisition
  4. Pre-boot user created
  5. Create 32 mb paritiion
  6. Recovery data sent to server
129
Q

FDE Recovery options

Full recovery with recovery media

A

Recovery files collected when initial FDE was established
As volumes are added to removed these activities are reflected in recovery info
Removes encryption without removing windows components
Restores boot record

130
Q

Where is recovery media tool

A

Client tun the useRec.exe
Location: c:\program files\Checkpoint\endpoiny security\full disk encryption
Run as an administrator

131
Q

FDE recovery options

Drive Slaving

A

Faster method extracting file from failed or encrypted drive
Dynamic Slave Utility
Access specific files on failed disks
Connect through USB
FDE auth is required

132
Q

FDE recovery options

Drive Mount Utilities

A

FDE auth not required

Used to access data of an FDE without doing recovery.

133
Q

How many types of media encryption are available in endpoint

A

2
Primary: Basic config, customizable read write permission & exclusions
Advanced Authorizatoin, Logging, policy violation (global permissions)

134
Q

Capsule Docs does what

A

Protects documents and controls access
Integrated AD, when doc created appropriate permission are appplied
2 action types:
- Primary= default encryption behavior, classification, snd permissions
- Advanced= Granular permission, applied ou level

135
Q

What does endpoint remote help provide

A

Allows admins to help users regain access from MEPP or FDE

136
Q

How many types of recovery help is offered by endpoint management

A

2
Type 1: User logon preboot remote help challenge response procedure
One-time-login
*Allows bypass pre-boot without resetting password
*Does not uncles their account
* Use for lost smart cards and gettin updated to clients.
Remote password change
*Change user password at pre-boot
*By padded pre-boot login.
*Will in unlock account

137
Q

How many types of recovery help is offered by endpoint management

A

2
Type 2 Media encryption remote help
*recovers removable media passwords remotely
* user must be authorized to use media

138
Q

Is remote help enabled by default in OneCheck policy

A

Yes

139
Q

What ways can you use recovery options

A
  1. Through smartendpoint

2. Through web portal

140
Q

What is address of web portal for recovery

A

HTTPS:///weary

141
Q

Features of one-time logon

A

Bypass preboot
Does not unlock account
Does not reset password

142
Q

Features of remote password change

A

Change password

Unlock account

143
Q

How do you enable remote help at pre-boot screen

A

Type is username and hit tab (this will show you remote help options)

144
Q

What types of attacks are targeting endpoint devices

A 
A. APT (Advanced Persistent Threat)’
    Large Scale
    State Sponsored
     Devastating damage
     Multi surface
B. Zero Day
    Target unknown software vulnerabilities
C. Bot attacks 
    Remote control of machine
D. Ransomware
145
Q

Is Sandblast agent part of network sandblast

A

No

146
Q

What are the advantageous of Sandblast mobile

A

Securing users outside the corp network
Protecting user who use removable media devices to share files
Blocking listeria threats
Detecting and preventing encrypted message that bypass security gateway

147
Q

What is anti-bot doing

A

Searching for malicious outgoing traffic using threat intelligence (threat cloud)
Detecting and blocking C&C attempts
Quarantine files as needed

148
Q

What are antibiotics actions and settings

A

Scans and assigns confidence interval to bot traffic
Default (detects and logs all bots with high confidence)
Exclusion list =domains, processed URLS, IP’s

149
Q

Is Anti-Malware signature based

A

Yes

150
Q

Features anti-malware

A

Signature based
Definition updates are coming from EMS , so need to maintain connectivity
Primary-scan scheduling
Advanced- Fine tune scan optimizations

151
Q

Anti-Ransomware features

A

Continuous monitoring of client file operations
Monitors computer processes and look for triggers
Behavioral Guard (detected and remediates all forms malicious behavior.
Anti-Ransomware= quarantine infected files by deleting and storing safe locatio
-Actions & Settings
Actions are based on threats confidence level
Exclusions are possible
Need 1 GB minimum disk storage’

152
Q

Whats is Threat extraction

A

Provides immediate response to malicious content in files. this is done by removing suspicious elements e.g macros

153
Q

What is threat emulation

A

Proactively detects zero day. Then it send to Sandbox (cloud or local) for emulation. Deep examination as also accomplished by monitoring individual file for compromise

154
Q

What is the inspection process look like

A

User downloads malicious file
SBA intercepts files and sends to sandblast service
Sandbox performs emulation
Extraction already providing clean content
Is suspicious = quarantine
If not suspicious send to recipient

155
Q

What two modes of enforcement in threat emulation

A

Detect and alert

Block

156
Q

What does ant-exploit accomplish

A

Monitors suspicious memory manipulation in running programs. It will shutdown exploited process when detected.
Actions and Settings:
Default=protect wed downloads with emulation, use cloud, inspect everything, 10MB emulation limit, add exclusions

157
Q

What does the browser extension for sandblast agent

A

Captures downloads for threat extraction and emulation

Continually looks client files in case a crazy event.

158
Q

recommendation deploying SBA

A
  1. Vigorously test SBA with the software used by those organization; thus ensuring that once turn on impact will be minimal
    Options Deployment
    -Default=use cloud for emulation
    -Or can leverage an appliance to the be used locally
159
Q

Why is a central login server a good idea

A

Takes the load of the other assets in the deployment, easier to correlate events.

160
Q

What software blades are included with SBA

A
  1. Behavioral guard
  2. Anti-exploit
  3. Anti-bot
  4. Anti-ransomware
  5. Forensics
  6. Threat extraction / threat emulation
161
Q

Default length for saving quarantined SBA files

A

90 days

162
Q

What does browser extension for threat emulation and threat extraction

A

Intercepts downloads and send them for extraction and emulation

163
Q

What type of reporting is provided by sandblast agent

A
  1. Predefined reports
  2. Alerts
  3. System operations
  4. Monitor
  5. Audit
  6. Client install / deployment
164
Q

What do alerts display

A

Endpoint clients in violation of rules

165
Q

What does push operations display

A

Displays recent activities:

Anti-malware scans and updates send directly to clients without policy install

166
Q

What does compliance show

A

Verifies compliance by software OS updates, Service packs…etc

167
Q

What does activity report show

A

Shows current activity status of clients, policy servers, users client connections and problems

168
Q

What does software deployment show

A

Deployment status errors and policies

169
Q

What does FDE show

A

Encryption status and problematic clients

170
Q

What does user authentication (OneCheck) show/

A

Pre-boot status, configured auth methods, last authentication

171
Q

What does MEPP Show

A

Displays all device connection event for last 14 days, reports all device connected to clients

172
Q

What does Anti-malware show

A

Status of Am detections and result for updates of clients

173
Q

What does ant-bot show

A

AB status

174
Q

What does license show

A

License usage

175
Q

What is the SmartEndpoint report structure

A

-Summary chart
Visual oveview of trends
Can be exported XLS, CSV, HTML, PDF
-Endpoint List
Detailed info for users and client machines
You can right click on the client to adjust behavior or rule settings

176
Q

How do you setup policy reports

A

Scheduled in the ESM and generated CSV file
Execute cpstop
Edit $UEPMDIR/engine/conf/local.properties file
Set time #emon.scheduler,time
Set max reports #emon.scheduler.max.reports
Enable report #emon.scheduler.policy report=true
Create new folder $fwdir/conf/smc_files
Cost art
2 field
General: user and client info
Policy: identified policy name and rules actions for each client

177
Q

How do forensics reports get generated

A

Automatically initiatives upon detection of a triggered event, file, or malicious behavior.
Report includes:
Entry point of suspicious file
Affected files
Remediation efforts
Suspicious behavior resulting from attack
Attack details

178
Q

Name diagnostic tool

A

CPinfo contains

  • all files data directory
  • installation log
  • file version info
  • Registry Values
  • Gina doll
  • SMBios structure
  • installed applications
  • Windows partition list

FDE state

  • Failure window encrypt/decrypt process
  • Identifying which disks have failures
  • FDE client issues

Check Point (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions