156-590 practice question 2 of 10

That Tracking option can be used to capture additional data for analysis by Check Point TAC?

Full set: 75 questions
Answer options
A: Alert
B: Forensics Correct answer
C: SNMP
D: User Defined
Correct Answer:
B. Forensics
Explanation

The "Packet Capture" tracking option provides the most comprehensive data for analysis by capturing the complete network packets for a session matching a rule. This level of detail is often requested by the Check Point Technical Assistance Center (TAC) to perform in-depth troubleshooting of complex network or security issues, as it allows them to reconstruct the entire network conversation and analyze protocol-level details.

Why Incorrect

A. The "Log" option generates a standard log entry with summary information, which is often insufficient for deep technical analysis.
C. The "Alert" option primarily serves as a notification mechanism and does not inherently add more technical data to the log than the standard "Log" option.
D. "Extended Log" adds more fields and context to a log entry but does not capture the full packet payload as "Packet Capture" does.

References

- Check Point. (2022). R81.10 Logging and Monitoring Administration Guide. Chapter 2: The Logging and Monitoring Process, "Tracking".

- Check Point. (2022). R81.10 Security Management Administration Guide. Chapter 5: The Rule Base, "Track Options".

Scroll to Top