2.2 Create and Apply NAT Policies NETWORK-SECURITY-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A firewall has two NAT policies: Policy 1 translates traffic from the Trust zone to the Untrust zone with source address 192.168.1.0/24 to 203.0.113.10. Policy 2 translates traffic from the Trust zone to the Untrust zone with source address 192.168.1.0/24 and destination port 80 to 203.0.113.11. The administrator notices that web traffic from the Trust zone is being translated to 203.0.113.10 instead of 203.0.113.11. What is the most likely cause?

   • AThe destination address in Policy 2 is incorrect
   • BPolicy 2 is listed above Policy 1 in the NAT rulebase
   • CThe security policy for web traffic is missing
   • DPolicy 1 is listed above Policy 2 in the NAT rulebase
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In a source NAT policy, what does the 'Dynamic IP and Port' (DIPP) option allow?

   • ATranslation of destination addresses for inbound traffic
   • BMultiple internal hosts to share a single public IP address using unique source ports
   • COnly one internal host to use a public IP address at a time
   • DA one-to-one mapping between internal and public IP addresses
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which tool can be used on a Palo Alto Networks firewall to verify that NAT is being applied correctly to traffic?

   • AUser-ID agent
   • BWildFire subscription
   • CPacket capture (PCAP)
   • DGlobalProtect portal
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a required attribute in the 'Original Packet' tab of a NAT policy?

   • ATranslated address
   • BDestination zone
   • CSource translation type
   • DSource address
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In a Palo Alto Networks firewall, what is the relationship between NAT policies and security policies?

   • ANAT policies are applied before security policies, and security policies must be configured to allow the translated traffic
   • BNAT policies and security policies are evaluated simultaneously
   • CSecurity policies replace NAT policies for all traffic
   • DSecurity policies are applied before NAT policies, and NAT policies must be configured to allow the original traffic
   Reveal Solution Discussion Select an answer first