Check Point Certified Security Administrator (CCSA) Practice Exam

Why is Jorge unable to see any logs if the Accept Implied Policy is set to "First"?

1. The log implied rule was set incorrectly in the rules base

2. The track log column is set to Full Log

3. The track log column is set to none

4. The log implied rule was not selected

The correct answer is: The log implied rule was not selected

When the Accept Implied Policy is set to "First," it refers to the firewall behaving in such a way that it accepts the first matching rule without evaluating further rules beneath it. If the log implied rule is not selected, the firewall will process the traffic according to the first matching rule found, but it won’t generate any logs for that action. This means that no logs will be created for connections that match that top rule. In this context, if Jorge is unable to see any logs, it is because the tracking for the implied rule has not been enabled, resulting in an absence of logging for accepted traffic. This is crucial for understanding how logging settings impact visibility into traffic and the effectiveness of monitoring and auditing firewall activity. The other options do not fully address the situation where logging is absent due to the configuration of implied rules. For example, if the implied rule had been set incorrectly, or if log settings were appropriate within the column, logs might still be generated unless the rule specifically prohibits tracking.