Check Point Certified Security Administrator (CCSA) R81.20 — Question 64

Which of the following log queries would show only dropped packets with source address of 192.168.1.1 and destination address of 172.26.1.1?

Answer options

• A. 192.168.1.1 AND 172.26.1.1 AND drop
• B. src:192.168.1.1 AND dst:172.26.1.1 AND action:Drop
• C. 192.168.1.1 OR 172.26.1.1 AND action:Drop
• D. src:192.168.1.1 OR dst:172.26.1.1 AND action:Drop

Correct answer: B

Explanation

Option B is correct because it specifically filters for packets where the source is 192.168.1.1 and the destination is 172.26.1.1 with the action set to Drop. The other options either use incorrect logical operators or do not specify both the source and destination addresses, leading to broader or incorrect results.