Which statement is a best practice concerning a Cleanup rule?

According to Check Point best practices, an explicit Cleanup rule should always be placed at the very bottom of the Access Control rule base. The purpose of this rule is to drop and log any traffic that has not been matched by any of the preceding explicit rules. While Check Point enforces an implicit drop at the end of the policy, the implicit drop does not log traffic by default. Adding an explicit Cleanup rule ensures that all unauthorized or unmatched traffic is properly recorded in the logs for auditing and troubleshooting purposes.

B: A Cleanup rule is highly recommended as a best practice specifically to ensure unmatched traffic is logged for auditing. C: A Cleanup rule is used to drop and log unmatched traffic, not specifically designed or used to terminate VPN tunnels. D: Placing a Cleanup rule at the top would drop all traffic immediately, preventing any legitimate traffic from being evaluated by subsequent allow rules.

Check Point R82 Security Management Administration Guide, Chapter: Access Control Policy, Section: Best Practices for Access Control.

Check Point Certified Security Administrator (CCSA) R82 Courseware, Module: Security Policy Management.