nerdexam
Check_Point

156-215.80 · Question #236

A Cleanup rule:

The correct answer is A. logs connections that would otherwise be dropped without logging by default.. A Cleanup rule at the bottom of the Rule Base explicitly drops and logs all traffic not matched by previous rules, ensuring that traffic dropped by the implicit drop is captured in logs.

Security Policy Management

Question

A Cleanup rule:

Options

  • Alogs connections that would otherwise be dropped without logging by default.
  • Bdrops packets without logging connections that would otherwise be dropped and logged by
  • Clogs connections that would otherwise be accepted without logging by default.
  • Ddrops packets without logging connections that would otherwise be accepted and logged by

How the community answered

(30 responses)
  • A
    87% (26)
  • B
    3% (1)
  • C
    3% (1)
  • D
    7% (2)

Why each option

A Cleanup rule at the bottom of the Rule Base explicitly drops and logs all traffic not matched by previous rules, ensuring that traffic dropped by the implicit drop is captured in logs.

Alogs connections that would otherwise be dropped without logging by default.Correct

Without a Cleanup rule, Check Point's implicit final rule silently drops all unmatched connections without generating any log entry. By adding an explicit Cleanup rule set to Drop with Track set to Log, administrators ensure that every dropped connection is recorded - providing full visibility into denied traffic. This is the primary purpose of the Cleanup rule: to make implicit drops visible in SmartView Tracker.

Bdrops packets without logging connections that would otherwise be dropped and logged by

This reverses the Cleanup rule's behavior - the Cleanup rule does log dropped connections, which is the opposite of dropping without logging.

Clogs connections that would otherwise be accepted without logging by default.

The Cleanup rule drops connections; it does not accept or allow traffic, so it cannot log accepted connections.

Ddrops packets without logging connections that would otherwise be accepted and logged by

The Cleanup rule explicitly logs all matched traffic - dropping without logging describes the behavior of the implicit drop rule that exists before a Cleanup rule is added, not the Cleanup rule itself.

Concept tested: Check Point Cleanup rule and implicit drop logging behavior

Source: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Firewall_AdminGuide/Topics-FW/Cleanup-Rule.htm

Topics

#cleanup rule#implicit drop#logging behavior#rule base

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 156-215.80 Practice