156-215.80 · Question #100
When a packet arrives at the gateway, the gateway checks it against the rules in the top Policy Layer, sequentially from top to bottom, and enforces the first rule that matches a packet. Which of…
The correct answer is C. If the Action is Accept, the gateway continues to check rules in the next Policy Layer down. In Check Point R80+ ordered policy layers, an Accept action passes the packet to the next layer for further evaluation rather than immediately allowing it through the gateway.
Question
When a packet arrives at the gateway, the gateway checks it against the rules in the top Policy Layer, sequentially from top to bottom, and enforces the first rule that matches a packet. Which of the following statements about the order of rule enforcement is true?
Options
- AIf the Action is Accept, the gateway allows the packet to pass through the gateway.
- BIf the Action is Drop, the gateway continues to check rules in the next Policy Layer down.
- CIf the Action is Accept, the gateway continues to check rules in the next Policy Layer down.
- DIf the Action is Drop, the gateway applies the Implicit Clean-up Rule for that Policy Layer.
How the community answered
(27 responses)- A4% (1)
- B4% (1)
- C78% (21)
- D15% (4)
Why each option
In Check Point R80+ ordered policy layers, an Accept action passes the packet to the next layer for further evaluation rather than immediately allowing it through the gateway.
An Accept action within one layer does not immediately allow the packet through the entire gateway; the packet must still be evaluated by subsequent Policy Layers.
A Drop action terminates packet processing immediately and discards the packet; it does not pass the packet down to the next Policy Layer for further rule evaluation.
In Check Point R80+ ordered policy layers, when a matching rule's action is Accept, the packet is forwarded to the next Policy Layer below for continued inspection rather than being immediately permitted through the firewall. This layered model allows stacking of security policies so that multiple layers must all permit traffic before it is truly allowed. Only after clearing all layers is the packet finally accepted.
A Drop action causes an immediate drop of the packet; the Implicit Clean-up Rule only applies when no explicit rule in a layer matches the packet at all.
Concept tested: Check Point R80 ordered policy layer Accept vs Drop behavior
Source: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Content/Topics-SMAG/Policy-Layers.htm
Topics
Community Discussion
No community discussion yet for this question.