Exam 156-315.80 topic 1 question 146 discussion

I agree, it's B. CCSE manual R80.10, page 228

This is done in Inbound Chain. B is correct

Inbound chain. According to the web search results, the inbound chain is the sequence of inspection points that a packet goes through when it arrives at the firewall from an external network. https://security.stackexchange.com/questions/10684/i-i-o-o-packet-inspection-points-inside-a-check-point-firewall. The inbound chain consists of four inspection points: i, I, o, and O. https://security.stackexchange.com/questions/10684/i-i-o-o-packet-inspection-points-inside-a-check-point-firewall. The decryption of encrypted packets happens at the I inspection point, which is also where VPN decryption and encryption occurs https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk64060https://security.stackexchange.com/questions/10684/i-i-o-o-packet-inspection-points-inside-a-check-point-firewall.

B. Done in inbound chain, verified in my own firewall via fw ctl chain command.

Inbound chain

[Expert@MyGW:0]# fw ctl chain in chain (23): 0: -7fffffff (0000000000000000) (00000000) SecureXL inbound (sxl_in) 1: -7ffffffe (0000000000000000) (00000000) SecureXL inbound CT (sxl_ct) 2: -7f800000 (ffffffff8b6812b0) (ffffffff) IP Options Strip (in) (ipopt_strip) 3: -7d000000 (ffffffff8a96ee80) (00000003) vpn multik forward in 4: - 2000000 (ffffffff8a97d830) (00000003) vpn decrypt (vpn) 5: - 1fffffa (ffffffff8a9533a0) (00000001) l2tp inbound (l2tp) 6: - 1fffff8 (ffffffff8b67f0e0) (00000001) Stateless verifications (in) (asm) 7: - 1fffff7 (ffffffff8b67ec00) (00000001) fw multik misc proto forwarding 8: - 1fffff2 (ffffffff8a982aa0) (00000003) vpn tagging inbound (tagging) 9: - 1fffff0 (ffffffff8a983460) (00000003) vpn decrypt verify (vpn_ver)

B. inbound chain, sounds correct.