At first I was thinking C, but to output to a file the command is: fw ctl zdebug > /var/log/tmp/fw_ctl_zdebug_drop.txt therefore C and by extension B cannot be correct and D cannot be correct as you cannot adjust the buffer in zdebug as it's fixed to 1024, therefore A is the only possible answer.

To me it's answer A. fw ctl zdebug is an internal R&D macros to cut corners when developing and testing new features in the sterile environment. It is equivalent to the following sequence of commands: fw ctl debug -buf 1024 fw ctl debug (your options) fw ctl kdebug -f fw ctl debug 0 (Please check https://checkpoint-master-architect.blogspot.com/2017/11/kernel-debug-best-practices-or-why-fw.html) This way, we can't modify buffer on zdebug and so we have to use fw ctl debug (and not zdebug).

zdebug does not allow the user to allocate a buffer. It automatically enables a 1MB buffer. So, this makes option A and D invalid. The only option is to save all information into a file.