Explanation: you don't have blocking rules inside your rulebase, all your blocking actions are made from "Block intruder" dialog box" at the active connection monitor in the log viewer. To unlock connection youcould unload the firewall module (fwstop command) or remove it manual, this is done without modifying the existing rulebase in policy editor. See page 108 from book "Essential Checkpoint Firewall 1".
Incorrect Answers
A:You don't have to modify the current rulebase from the policy editor. You take you unblocking action unloading the firewall or unblocking the connections manually. See explanation above for more information.

Explanation: its difficult to explain without the exhibit, but the answer is B, the statement exposed in the question is not true, its false. The NAT rules are not simply hidden.
Incorrect AnswersA:This answer is wrong because the NAT rules aren't simply hidden, is hard to explain without the exhibit.

Explanation: by default, in the case of Telnet (Port TCP 23) you only need one rule allowing the traffic from the inside or from the outside of the firewall, any reply to that Telnet connection request will be allowed by the firewall because of the connection tracker database located at the gateway. This behavior can be configured to work in a different fashion depending on the implementation requirements.
Incorrect Answers
A:You don't need 2 rules for a Telnet request and a Telnet reply because if the connection is allowed with the first rule through the gateway, the reply is expected in connection tracker database inside the gateway.

Explanation: making this actions, you will make the packets hide behind the exit interface, this is because of the address specified. Refer to Checkpoint Online Documentation to see how the whole process work.
Incorrect Answers
B:The connection needs to be iniciated by the client, not the server.
C:You can't hide the IP address of the server with the client one.
D:You can't translate a source address to 0.0.0.0.
E:You can't translate outbound packets in the server to a 0.0.0.0. address.