The correct answer is B. An Explicit Cleanup Rule should be added at the end of each Ordered Layer. Check Point layers already have implicit cleanup behavior, but relying on implicit cleanup is weak operational practice because the implicit rule may not be visible in the rulebase and may not provide the administrator’s desired logging. An explicit cleanup rule makes the default handling clear, visible, and auditable. Option A is wrong because the implicit cleanup rule exists automatically; the administrator does not add it manually. Option C is incomplete because logging is normally configured through the Track column of a rule, not added as a separate “logging rule” type. Option D is wrong because NAT rules belong in the NAT policy/rulebase, not at the end of each Ordered Access Control Layer. In a secure positive-control firewall model, explicitly allow required traffic, explicitly drop unwanted/unmatched traffic, and log cleanup matches where investigation or compliance requires visibility. Reference topics: Ordered Layers, Explicit Cleanup Rule, Implicit Cleanup Rule, Access Control best practices.