View all questions & answers for the Check Point Certified Security Administrator (CCSA) R82 Exam Materials exam
Check Point Certified Security Administrator (CCSA) R82 Exam Materials-Question 165 Discussion
Comments
Selected Answers: B
Per the R82 Security Management Administration Guide: if none of the higher rules in the Ordered Layer match the packet, the explicit Cleanup Rule is applied, and if that rule is missing, the Implicit Cleanup Rule takes over instead. Check Point's best-practice guidance explicitly recommends adding an explicit cleanup rule at the bottom of each Ordered Layer with a defined action (e.g., drop or accept), rather than relying on the implicit one.
Why the other options are wrong:
- **A. Implicit Cleanup Rule** — This exists automatically as a fallback, but it isn't something you add — it's a hidden, non-configurable rule that applies only when no explicit cleanup rule is present, and it doesn't generate log entries. The recommended practice is to add an explicit one instead.
- **C. Logging Rule** — This isn't a defined rule type in the Ordered Layer structure; logging is a rule attribute (a Track setting) applied to individual rules, not a standalone rule you place at the end of a layer.
- **D. NAT Rule** — NAT is configured in its own dedicated NAT policy/rule base, not as a required closing rule within an Ordered Layer of the Access Control policy.
What should be added at the end of each Ordered Layer? (Choose one answer)
Brave-Dump Clients Votes