Check Point Certified Security Administrator (CCSA) Practice Exam

Which of the following log queries would show only dropped packets with source address of 192.168.1.1 and destination address of 172.26.1.1?

1. src:192.168.1.1 OR dst:172.26.1.1 AND action:Drop

2. src:192.168.1.1 AND dst:172.26.1.1 AND action:Drop

3. 192.168.1.1 AND 172.26.1.1 AND drop

4. 192.168.1.1 OR 172.26.1.1 AND action:Drop

The correct answer is: src:192.168.1.1 AND dst:172.26.1.1 AND action:Drop

The query that shows only dropped packets with the specific source address of 192.168.1.1 and destination address of 172.26.1.1 is structured to require both conditions to be true, making it the most precise and effective option for this scenario. When using logical conditions in query languages, combining criteria with "AND" means that all specified conditions must be met for a record (in this case, a log entry) to be included in the result set. By requiring the source address to be 192.168.1.1 and the destination address to be 172.26.1.1, along with the action being "Drop," this query will filter the logs to display only the packets that match these exact parameters. The other queries either use "OR," which would increase the number of results to include packets from or to the specified addresses without being specific about both being required, or do not structure the logical conditions properly to isolate just the dropped packets. For example, the combination of "src:192.168.1.1 OR dst:172.26.1.1 AND action:Drop" could result in including packets that are either from the first source or to the second destination, regardless