Explanation:
the cleanup rule should always be the last rule in the rulebase, because it will drop or log (depending on your actions) all the traffic, it will always match the traffic that gets through it.
Incorrect Answers:
2: It should be the last rule, see the explanation for details.

---