The correct answer is B. In an Ordered Layer, rule matching proceeds from top to bottom until a rule matches. If the matching rule’s action is Drop, the Security Gateway drops the packet and does not continue evaluating later rules or additional ordered layers for that packet. Official R82 rule-matching examples show that a final drop match stops further inspection and the gateway does not turn on inspection engines for other rules. Option A is unrelated because encryption is a VPN/IPsec behavior, not the result of a Drop action. Option C is wrong because dropped traffic is not forwarded; it may be logged depending on the Track setting, but forwarding does not occur. Option D is wrong because a Drop action terminates evaluation rather than passing traffic to the next layer. This is one of the most important policy-layer mechanics: Drop is final, while Accept in layered policy may still require additional ordered-layer evaluation. Reference topics: Ordered Layers, Drop action, Access Control rule matching, policy-layer enforcement.

The correct answer is D. In Check Point Identity Awareness, identity-based matching in the Access Control policy is performed with Access Role Objects. An Access Role can combine user identity, computer identity, and network location into one policy object used in the Source or Destination columns. Option A is too vague and does not name the correct object type. Option B is wrong because AD Query is an identity acquisition source, not the policy object used to match users in the rulebase. Option C is incomplete because raw user or group objects alone are not the primary R82 Access Control rulebase mechanism for identity matching; Access Roles are used to express identity conditions properly. The practical design is: collect identities using sources such as AD Query, Identity Collector, Identity Agents, Browser-Based Authentication, RADIUS Accounting, or Identity Web API; then enforce access using Access Roles in the policy. Reference topics: Identity Awareness, Access Roles, user/computer identity matching, Access Control policy.

The correct answer is A. Session management controls include Session Comments, which help administrators document the purpose, scope, or reason for a session’s changes. This is useful in multi-administrator environments because session comments improve accountability and make later review easier. Option B is wrong because “Session Import/Export” is not a standard session-management control in this context. Option C is misleading because the Check Point workflow uses Publish and Discard, not “Session Save” as the tested control name. Option D sounds plausible because sessions can have identifying information, but the specific supported control listed in the course-style answer set is Session Comments. The key administrative practice is disciplined change documentation: name or describe changes clearly, use comments where available, publish only reviewed work, and compare revisions when troubleshooting or auditing. SmartConsole’s session model exists so administrators can work safely without instantly changing the shared management state until publication. Reference topics: SmartConsole sessions, session comments, change documentation, Publish/Discard workflow.