Free 156-582 Practice Test Questions and Answers (2026)

The IPsec VPN negotiation process, managed by the Internet Key Exchange (IKE) protocol, establishes two distinct types of Security Associations (SAs). First, the IKE SA (also known as Phase 1 SA) is created. This is a bidirectional SA that secures the negotiation traffic itself, establishing an authenticated and encrypted channel between the VPN peers. Once the IKE SA is established, it is used to securely negotiate the IPsec SAs (also known as Phase 2 SAs). The IPsec SAs are unidirectional and are used to encrypt and decrypt the actual user data traffic that passes through the VPN tunnel.

A. IKE and VPND SA: vpnd is the name of the Check Point daemon (process) responsible for VPN operations, not a type of Security Association.

B. IKE SA and VPN SA: While an IPsec SA is a type of "VPN SA," this term is too generic. "IPsec SA" is the specific, standardized term for the data-plane SA.

D. VPN SA and Main SA: "Main SA" is not a standard term. It incorrectly conflates "Main Mode," one of the negotiation modes in IKEv1, with the SA itself.

1. Check Point R81.20 VPN Administration Guide: In the "Site-to-Site VPN" chapter, section "IKE (Internet Key Exchange) and IPsec", the documentation states, "The IKE negotiation generates the authenticated and encrypted channel, known as the IKE Security Association (SA). The IKE SA is used to securely negotiate the IPsec SAs. The IPsec SAs are used to encrypt and decrypt the data in the IPsec tunnel."

2. RFC 7296 - Internet Key Exchange Protocol Version 2 (IKEv2): Section 1.2, "The Two Phases of IKE," describes the process: "The first phase is the establishment of an IKE SA... The second phase involves using that IKE SA to negotiate security associations for other protocols, such as AH and ESP for IPsec." This foundational document clearly distinguishes the IKE SA from the subsequent IPsec SAs (referred to as Child SAs). (DOI: 10.17487/RFC7296)

3. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 8, "Security in Computer Networks," the section on IPsec and IKE explains that IKE establishes a secure channel (the IKE SA) to negotiate the parameters for the IPsec SAs that will carry the data.

The top command provides a dynamic, real-time view of a running system. Its output is divided into two main sections. The top summary area displays system-wide statistics, including overall CPU utilization (e.g., %us, %sy, %id) and memory usage (total, free, used). The lower section lists the currently running processes, ordered by resource consumption, showing individual process details like Process ID (PID), user, and specific CPU and memory percentage utilization. This single utility comprehensively fulfills all requirements of the question.

A. df: This command reports file system disk space usage and available space, not CPU, memory, or process resource consumption.

B. free: This command displays the total, used, and free amounts of physical and swap memory but does not provide CPU or per-process utilization details.

C. ps: This command provides a static snapshot of current processes at a single point in time. While it can show process resource usage, it lacks the real-time, continuously updating summary of overall system CPU and memory that top provides.

1. Check Point Gaia R81.20 CLI Guide: In the chapter "System Commands", the top command is described as the utility to "Display Linux processes". The example output clearly shows the summary header with CPU states (Cpu(s)), memory (Mem), and swap (Swap) statistics, followed by the list of individual processes with their resource utilization columns (%CPU, %MEM). (Reference: Check Point Gaia R81.20 CLI Guide, Page 198).

2. University of Illinois, CS 241: System Programming Courseware: Lecture notes on "Processes" describe standard Linux utilities. The top command is introduced as a tool that "shows you a sorted list of processes and vital statistics about the machine (e.g., uptime, memory, and CPU usage)." This confirms its dual role in showing both system-wide and per-process statistics. (Reference: CS 241, University of Illinois Urbana-Champaign, Fall 2021, Lecture 04: Processes, Slide 45).

3. Linux Programmer's Manual (man page): The official manual page for the top command, top(1), states in its description: "The top program provides a dynamic real-time view of a running system. It can display system summary information as well as a list of processes or threads currently being managed by the Linux kernel." (Reference: top(1) Linux manual page, DESCRIPTION section).

cppcap is a Check Point utility specifically designed for high-performance packet capture. It is part of the Check Point Packet Capture (CPPC) suite and is engineered to be more efficient and have a lower CPU performance impact than the standard tcpdump utility. When tcpdump causes a significant CPU increase on a high-load Security Gateway, cppcap is the recommended alternative for capturing packets at the OS kernel level with minimal system resource consumption.

A. fw monitor is a powerful debugging tool for inspecting packets as they pass through the firewall's kernel inspection chain, not a general-purpose, low-level packet capture tool like tcpdump.

B. Waiting for off-peak hours is a procedural workaround to mitigate impact; it is not a technical alternative that solves the underlying high CPU usage problem of the tool itself.

D. The tcpdump -e option prints the link-level header for each packet. It does not reduce the capture length or CPU utilization. The -s (snaplen) option is used to limit capture length.

1. Check Point Support Center, sk111013 - "CPPC - Check Point Packet Capture": This document introduces cppcap and states, "CPPC is a new packet capture utility that is intended to replace tcpdump for advanced debugging purposes. It is more efficient than tcpdump and has a lower performance impact." This directly supports cppcap as the correct alternative for high CPU issues.

2. Check Point Support Center, sk30583 - "How to run 'fw monitor'": This article describes the purpose and usage of fw monitor, clarifying that its function is to "see the traffic and the way it is being processed by the firewall kernel." This differentiates it from a raw packet capture tool.

3. Tcpdump Man Page (tcpdump.org): The official manual page for tcpdump describes the -e flag as "Print the link-level header on each dump line." This confirms that option D provides an incorrect description of the flag's function.

Running tcpdump without specifying an interface can cause it to listen on the any pseudo-interface, capturing traffic from all interfaces. On a busy Security Gateway, this processes a massive number of packets, leading to high CPU utilization. The -i flag allows you to specify a single network interface (e.g., tcpdump -i eth0). This restricts the capture to only the traffic passing through that specific interface, significantly reducing the packet processing load and thereby lowering CPU usage. This is a fundamental technique for controlling the scope and performance impact of tcpdump.

A. o: The -o flag is not a standard, valid option for the tcpdump command. It is a valid flag for the Check Point fw monitor command to specify an output file.

B. O: The -O flag explicitly disables the packet-matching code optimizer in tcpdump. This would likely increase CPU usage, making the performance problem worse, not better.

C. I: The -I flag in tcpdump is used to put an interface into "monitor mode," a feature typically used only for 802.11 wireless interfaces and is not a performance optimization tool for gateway traffic.

1. Check Point SK30583, "How to use tcpdump": This article details the usage of tcpdump on Check Point appliances. It lists -i as the option to "Listen on a particular interface." This directly supports the use of -i to limit the scope of the capture.

2. tcpdump(8) Linux man page: The official manual for tcpdump confirms the function of the flags.

-i interface: "Listen on interface. If unspecified, tcpdump searches the system interface list for the lowest numbered, configured up interface (excluding loopback)..." On some systems, the any device can be used to capture from all interfaces.

-O: "Do not run the packet-matching code optimizer."

-I: "Put the interface in 'monitor mode'; this is supported only on IEEE 802.11 Wi-Fi interfaces..."

3. Check Point SK162334, "'fw monitor' command": This article describes the flags for the fw monitor utility, which is often confused with tcpdump. It shows that -I is a valid flag for fw monitor (specifying an inspection point), explaining the likely source of confusion for option C. It also shows -o as the flag for an output file, explaining the confusion for option A.

The fw monitor command-line utility uses the -p flag to specify packet capture points within the firewall inspection chain. This flag accepts several types of position specifiers. You can specify an absolute position using a numerical index, a relative position using a module's unique ID, or a relative position using a predefined alias (e.g., 'fw', 'vpn'). The term "location" is not a valid or recognized keyword or specifier within the fw monitor syntax for defining a relative position in the chain. Therefore, it is not a valid method for inserting a capture point.

A. Relative position using id: This is incorrect. fw monitor allows specifying a capture point relative to a specific chain module's unique hexadecimal ID (e.g., -p 0x80000004).

B. Absolute position: This is incorrect. fw monitor supports using a numerical index to specify an absolute position in the inspection chain (e.g., -p 4).

D. Relative position using alias: This is incorrect. fw monitor commonly uses well-known aliases like 'fw' or 'vpn' to define capture points relative to key inspection modules.

1. Check Point R81.10 CLI Reference Guide, Page 338, under the fw monitor command description for the -p flag. It states, "The position can be: An absolute position in the chain (a number). A relative position to a known position (for example, fw or vpn). A relative position to a specific hook (by its ID)."

2. Check Point SecureKnowledge (SK) Article sk30583: "How to use the 'fw monitor' command". In the section describing the -p parameter, it lists the valid position parameters as: "An absolute position in the chain (a number)", "A relative position to a known position (e.g., fw or vpn)", and "A relative position to a specific hook (by its ID)". The term "location" is not mentioned as a valid specifier.

The cpwdadmin list command is the correct tool for this task. cpwd is the Check Point WatchDog process, which is responsible for monitoring the state of critical Check Point daemons. The cpwdadmin utility is used to interact with and manage the WatchDog. The list argument specifically instructs the utility to display a table of all processes currently under WatchDog's supervision, including their Process ID (PID), status (e.g., 'E' for executing), and start time. This directly fulfills the requirement to print the status of WatchDog-monitored processes.

B. tcpdump: This is a standard command-line packet analyzer; it captures network traffic and is not used for monitoring process status.

C. cppcap: This is a Check Point utility for capturing network packets, similar to tcpdump but with specific kernel integrations. It does not show process status.

D. cpplic print: This command is used to view and manage Check Point software licenses installed on the system, not for process monitoring.

1. Check Point R81.10 CLI Reference Guide:

Page: 198

Section: cpwdadmin

Quote: "Use the cpwdadmin command to configure the Check Point WatchDog... cpwdadmin list - Shows the list of processes monitored by WatchDog and their status, pids, etc."

2. Check Point Support Center, SK Article sk33832:

Title: Check Point WatchDog

Section: Important cpwdadmin commands

Content: The article lists cpwdadmin list as the command to "show the list of processes monitored by WatchDog and their status."

The primary command-line utility for managing and verifying Check Point's subscription-based licenses, known as "Smart Contracts," on a Security Gateway is contractsmgmt. This tool allows administrators to fetch, attach, detach, and view the status of contracts directly from the command line. Additionally, the cpconfig utility, a general-purpose configuration tool, provides a menu-driven interface that includes an option for "Licenses and contracts," allowing for their verification and management. These two commands are the standard methods for this task.

B. cpcontract is not a valid or recognized Check Point command-line utility.

C. cpinfo is a diagnostic tool used to collect comprehensive system data for support cases, not for direct contract verification. cplic is a valid but older utility for managing traditional licenses.

D. contractjtil is not a valid or recognized Check Point command-line utility.

1. Check Point R81.1 CLI Reference Guide, Page 219, "contractsmgmt": "Use the contractsmgmt command to manage contracts on a Security Gateway. You can use this command to: Fetch contracts from the User Center. Attach a contract to the Security Gateway. Detach a contract from the Security Gateway. Show information about contracts."

2. Check Point R81.1 CLI Reference Guide, Page 225, "cpconfig": "Use the cpconfig command to configure a Check Point Security Gateway... The Check Point Configuration Tool menu opens. It shows these options: ... (5) Licenses and contracts".

3. Check Point R81.1 Security Administration Guide, Page 101, "Managing Licenses from the Command Line": "On a Security Gateway, you can run CLI commands to manage licenses and contracts. For contracts, use the contractsmgmt command. For licenses, use the cplic command." This highlights contractsmgmt as the specific tool for contracts.

The Check Point logging architecture relies on the FireWall Daemon (fwd) process for log transmission. On a Security Gateway, the fwd process collects logs generated by the firewall kernel and forwards them to the Log Server, which is typically the Security Management Server. This communication for the fw.log service is standardized to occur over TCP port 257. The fwd process on the Security Management Server listens on this port to receive, process, and index the incoming logs from the gateways.

B. The cpm process on port 19009 is used for communication between SmartConsole clients and the Security Management Server, not for log forwarding from a gateway.

C. The fwm process on port 18190 is the primary management process used for tasks like policy installation, not for receiving logs from gateways.

D. The fwm process is incorrect for log forwarding; the fwd process handles this function.

1. Check Point Support Center, SecureKnowledge (SK) Article sk25921: "Ports used for communication by Check Point software". This official document explicitly lists the services, ports, and processes.

Section/Table: Under the "Security Management Server" and "Security Gateway" sections.

Entry: Service Name: fw.log, Port: 257/tcp, Process: fwd.

Description: "Log connection. Used by the Security Gateway to send logs to the Security Management Server / Log Server."

2. Check Point R81.20 Logging and Monitoring Administration Guide: This guide details the architecture of the logging system.

Chapter: "Logging Architecture"

Content: The guide describes the log flow from the Security Gateway kernel to the fwd process, which then sends the logs to the Log Server. It states, "The FWD process on the Security Gateway sends logs to the FWD process on the Log Server." This confirms the role of the fwd process in log transmission.

The INTERNALPOLICYLOADING=1 environment variable is an advanced debugging flag used on the Check Point Security Management Server. When set, it enables detailed logging for the Threat Prevention policy conversion process. This specific task of compiling, converting, and preparing the policy for distribution to Security Gateways is handled by the Firewall Management (fwm) process. Therefore, enabling this flag directly affects the fwm process, allowing administrators and support to trace and troubleshoot issues that occur during this critical phase of policy installation.

B. cpm: The cpm process is the main Check Point management server process, but fwm is the specific worker process responsible for policy compilation and installation.

C. solr: Solr is the search and indexing engine used by SmartLog for log data; it is not involved in policy conversion or installation.

D. dlpd: dlpd is the Data Loss Prevention daemon that runs on the Security Gateway, not the management process that converts the policy.

1. Check Point SecureKnowledge (SK) Article sk113599: "How to debug Threat Prevention policy installation". In the section "Debug on Security Management Server", the procedure explicitly states: "To enable debug of the policy conversion process, set the following environment variable on the Security Management Server: export INTERNALPOLICYLOADING=1" and immediately follows with the instruction to "debug the FWM process that compiles and installs the policy". This directly links the variable to the fwm process.

2. Check Point R81.10 Security Management Administration Guide: In the chapter "System Management and Monitoring", section "Processes and Daemons", the fwm process is described as being responsible for crucial management tasks, including "Compiling and installing Security Policies". This confirms that fwm is the correct process for policy compilation and conversion activities.

Check Point provides several licensing models to meet different customer needs.

Perpetual: A one-time purchase that grants a permanent right to use the software. Support and updates require a separate, renewable contract.

Subscription: A time-based license (e.g., 1, 2, or 3 years) that bundles the right to use the software with support, updates, and upgrades for the duration of the term.

Evaluation/Trial: Temporary licenses, typically for 15 or 30 days, that allow potential customers to test the full functionality of a product before purchasing. While functionally similar, "Trial" is often used in marketing, leading to an "Evaluation" license in the User Center.

B. Evaluation, Perpetual, Test, Free: "Test" is not an official Check Point license category; the correct term is "Evaluation" or "Trial". "Free" is not a primary commercial model.

C. Free, Evaluation, Annual, Lifetime: "Annual" describes a common subscription duration, not a distinct license type. "Lifetime" is a synonym for the official term "Perpetual".

D. Annual, Perpetual, Test, Free: This option contains multiple incorrect terms. "Annual" is a duration, and "Test" is not an official license type.

1. Check Point R81.20 Security Management Administration Guide: In the chapter on "Managing Licenses and Contracts," the guide explicitly details the process for generating and installing an Evaluation license. This confirms "Evaluation" as an official license type for product testing. (See Chapter: Managing Licenses and Contracts > Licensing > Adding a New License).

2. Check Point Infinity Total Protection Datasheet: This official document describes the offering as an "all-inclusive, per-user, per-year subscription." This establishes "Subscription" as a core licensing model for Check Point's modern security solutions. (See section: "Simple All-Inclusive Security").

3. Check Point Quantum Security Gateway Appliance Datasheets: These documents typically outline the purchase of the hardware appliance, which grants a Perpetual right to use the base Gaia operating system. Software blade functionality is then added via subscriptions. This illustrates the long-standing "Perpetual" model. (See any Quantum appliance datasheet, e.g., for the 3800 series, under "Ordering Information").

4. Check Point Official Website (checkpoint.com): The main product pages frequently feature "Start a Free Trial" or "Request a Demo" buttons. This marketing terminology is the public-facing entry point for obtaining a temporary Evaluation license, validating "Trial" as a recognized term in the Check Point ecosystem.

The Check Point Security Management Server, when functioning as a Log Server, receives logs from Security Gateways via the fw.log process. This process listens on TCP port 257 by default. The Firewall Daemon (FWD) process on the Security Gateway establishes a connection to this port on the Log Server to transmit log data. This is the primary and legacy mechanism for log collection in the Check Point architecture.

A. 18191: This port is used by the CPD (Check Point Daemon) process for Secure Internal Communication (SIC), primarily for operations like policy installation and status updates, not log collection.

B. 443: This is the standard port for HTTPS. It is used for web-based management (e.g., Gaia Portal) and for SmartConsole client connectivity to the Security Management Server.

C. 258: This port is used by the FWD process when a Log Server forwards logs to another Log Server. It is not used for the initial log collection from a Security Gateway.

1. Check Point Support Center, SecureKnowledge sk22564: "Ports used for communication by Check Point software". In the table "Ports on Security Management Server / Log Server / SmartEvent Server / Multi-Domain Server", the entry for port 257/tcp explicitly states the service is "Logging and monitoring" and the description is "Log server accepts logs from gateways (FWD process)".

2. Check Point R81.20 Logging and Monitoring Administration Guide: In Chapter 1, "Introduction to Logging", the section "The Logging Process" describes how logs are generated on the Security Gateway and sent by the fwd process to the Log Server. The communication port for this process is detailed in official port lists as 257.

3. Check Point R81.20 Security Management Administration Guide: In Chapter 2, "Security Management Architecture", the section "Communication and Security" implicitly covers the different communication channels. It reinforces that different daemons use specific ports for their functions, with logging being a distinct channel from management (CPD) or GUI access (HTTPS).

The Resource Advisor Daemon (RAD) is the core process for the URL Filtering and Application Control blades. When a user requests a URL, the Security Gateway first checks its local cache. If the URL is not in the cache, or if the cache limit has been exceeded causing frequent evictions, RAD must query the Check Point Online Web Service in the cloud. This cloud lookup is a significantly more resource-intensive operation than a local cache hit. When the cache limit is consistently exceeded under heavy traffic with many unique URLs, the gateway is forced to perform a large number of these cloud lookups, causing the RAD process's CPU utilization to spike, often reaching near 100 percent.

A. The URL Filtering blade is not disabled when the cache limit is reached, as this would create a significant security gap in the organization's policy enforcement.

B. Spawning multiple RAD processes is not the designed behavior for a full cache; this would likely exacerbate resource contention rather than resolve the issue.

D. The Security Gateway does not dynamically raise the cache limit indefinitely. The cache has a configurable, but fixed, memory allocation to prevent uncontrolled memory consumption and maintain system stability.

1. Check Point SecureKnowledge (SK) Article sk109676: "RAD process consumes high CPU on Security Gateway with enabled URL Filtering blade".

Symptom Section: "RAD process on Security Gateway with enabled URL Filtering blade consumes close to 100% of one CPU core."

Cause Section: "When the URL Filtering cache limit is reached, every new URL request that is not in the cache requires a query to the Check Point Online Web Service. This causes the RAD process to consume high CPU."

2. Check Point SecureKnowledge (SK) Article sk112153: "URL Filtering cache memory allocation".

Solution Section: This article details the kernel parameters for managing the URLF cache size (e.g., radurlfcachesize). It explains that there is a defined limit and describes the mechanism: "When the cache limit is reached, the oldest entries are replaced with new ones (LRU - Least Recently Used algorithm)." This confirms the cache has a fixed limit and does not grow dynamically (contradicting option D).

3. Check Point R81.1 Security Gateway Administration Guide:

Chapter: Monitoring Gateway Performance > CoreXL and Performance Tuning. While not directly stating the cache limit issue, this guide discusses how features like Application Control & URL Filtering are CPU intensive and require careful monitoring. It reinforces that processes like RAD are critical to performance and that resource exhaustion (like high CPU) is a key monitoring metric, which aligns with the problem described.

In a Check Point environment, the Security Management Server (SMS) serves as the central point for managing licenses and service contracts. The SMS connects to the Check Point User Center to download the latest contract information. Once the valid service contracts are stored on the SMS, they are then automatically distributed to the managed Security Gateways. This architecture ensures centralized control and allows the gateways to validate their software blade entitlements and fetch necessary updates, such as signatures for the Threat Prevention blades.

A. Contracts are managed centrally on the Security Management Server and then distributed to the gateways; they are not stored only on the gateways.

B. Service contracts are digital files managed electronically through the Check Point User Center and SmartConsole, not provided on paper.

C. While contracts are stored and required on the SMS, they are also downloaded to the Security Gateways so the gateways can validate their services and download updates.

1. Check Point R81 Security Management Administration Guide, Chapter "Managing Licenses and Contracts", Section "Updating Contracts".

Quote/Paraphrase: The guide states, "The Security Management Server periodically connects to the Check Point User Center to get updated contract and license information. The Security Management Server then automatically distributes the updated information to the managed Security Gateways." This confirms the process where the SMS must first have the contract before it can be sent to a gateway.

2. Check Point SecureKnowledge (SK) Article sk94508: "How to update Contract File on Security Management Server / Multi-Domain Server".

Reference: This document outlines the procedures for updating the contract file directly on the management server, either automatically or manually. This reinforces the role of the SMS as the primary repository for contract information before it is distributed to other components.

3. Check Point SecureKnowledge (SK) Article sk110548: "How to update Contract File on Security Gateway / Cluster Member".

Reference: This article details how a gateway's contract file is updated. It explicitly mentions, "The recommended way to update the contract file on a Security Gateway / Cluster Member is to update it on its Security Management Server / Domain Management Server... and then install the policy." This directly supports the answer that the contract must be on the SMS first.

The command fw monitor captures packets at four distinct points in the Firewall kernel chain, often referred to as the FW Virtual Machine (VM). These points represent the packet's state before and after the inbound and outbound kernel chains are processed. The -p all option, contrary to what its name might imply, does not capture at a larger number of intermediate kernel module points. Instead, it modifies the output to display the full packet path through all kernel chains for each of the four captured packets, providing a comprehensive view of the packet's journey. Therefore, the command still fundamentally takes only four captures.

A. The number of kernel modules is not fixed at 15 and can vary. More importantly, fw monitor does not capture packets at every single module interface with the -p all flag; it captures at the four main points.

B. This option incorrectly describes the function of the -p flag. The flag for controlling the captured data length (gathering the entire packet) is -l, not -p.

C. This is conceptually incorrect. fw monitor does not capture "1 from every module." It captures at the four key inspection points at the beginning and end of the inbound and outbound chains.

1. Check Point SecureKnowledge (SK) Article sk111013: "How to debug packet flow with 'fw monitor' in R80.x". This document clarifies the behavior of fw monitor. In the section "FW Monitor flags", it explains the default capture points. The -p flag is described as controlling the "positions in the FW chain to inspect". The all parameter for -p is specifically noted to show the packet's path through the chains for the captures taken at the four standard points.

2. Check Point R81.10 Security Gateway Administration Guide: In the "Monitoring and Troubleshooting" chapter, the fw monitor command is detailed. The guide explains that the tool captures packets at four points by default: before the inbound chain (i), after the inbound chain (I), before the outbound chain (o), and after the outbound chain (O). The -p all option is documented to provide a "trace of the packet through the firewall chains," which is an enhancement of the output for the four captured packets, not an increase in the number of capture points.

3. Check Point Certified Security Expert (CCSE) R81.10 Courseware: The official training materials for the CCSE certification, which the 156-582 exam is based on, explicitly state that fw monitor captures packets at four points. The -p all flag is taught as a method to see the detailed kernel chain path for each of these four captures, not as a way to generate more captures.

To log the full URL for traffic matching a specific rule in the Access Control policy, the "Extended Log" track option must be selected for that rule. This is a per-rule setting configured in the "Track" column of the Rule Base. According to Check Point's official documentation, when "Extended Log" is enabled for a rule involving the Application Control blade, the generated log entry is enriched with more detailed information, which explicitly includes the full URL of the request. This provides granular control over logging verbosity for specific traffic without affecting the entire policy.

B. This describes a setting that does not exist in the specified location. The correct option is "Extended Log," not a "log URL" setting.

C. This is incorrect. Verbose logging, such as capturing full URLs, is not enabled by default to conserve system resources and log storage.

D. This refers to global blade settings. The question requires a configuration for a specific rule, not a global change that would affect all rules.

1. Check Point R81.10 Security Management Administration Guide, Chapter: "The Access Control Policy", Section: "Configuring the Track Setting for a Rule", Page 371.

The guide states: "For some rules, you can select Extended Log. This gives a more detailed log entry. For example, for a Firewall rule, an Extended Log includes the rule number. For an Application Control rule, an Extended Log includes the full URL."

2. Check Point R81.1 Certified Security Administrator (CCSA) Study Guide, Chapter 6: "Monitoring Security Gateways", Section: "Tracking and Logging", Page 161.

This official courseware lists "Extended Log" as a tracking option and explains it "Generates a log with a more detailed description than the Log option," confirming its purpose for enhanced logging detail.