An administrator is troubleshooting a NAT issue where internal users can access the internet, but the return traffic is not reaching them. The firewall has a source NAT policy that translates Trust to Untrust. The administrator checks the session table and sees that the session is established. What is the most likely cause?

The security policy for return traffic is missing

The firewall does not have a route back to the internal network

The internal host's default gateway is not set to the firewall

The NAT policy is not configured for bidirectional translation

When would you use a destination NAT policy on a Palo Alto Networks firewall?

To translate the source address of outbound traffic

To provide a one-to-one mapping between public and private IP addresses

To translate the destination address of inbound traffic to an internal server

To hide internal IP addresses from the internet

Users report that they cannot reach an internal server from the internet. The firewall has a destination NAT policy that translates the public IP 203.0.113.20 to the private IP 10.10.1.20 for service HTTPS. A security policy allows HTTPS from the Untrust zone to the DMZ zone. The administrator checks the traffic logs and sees that packets are being dropped. What should the administrator check next to diagnose the issue?

Verify that the firewall has a route to the public IP 203.0.113.20

Verify that the security policy uses the post-NAT destination address (10.10.1.20) in its destination field

Verify that the NAT policy is listed above any other NAT policies that might match the same traffic

Verify that the NAT policy has a translated source address set to the public IP

An administrator has configured a destination NAT policy for a web server. The security policy allows HTTPS from Untrust to DMZ. Users can access the web server from the internet, but the server logs show that the source IP of the clients is the firewall's internal IP (10.10.1.1) instead of the actual client IP. What is the most likely cause?

The web server is behind a load balancer that is performing NAT

The security policy is configured to translate the source address

The firewall is not performing NAT correctly

The NAT policy is configured to translate the source address to the firewall's internal IP

Palo Alto NetworksCertified Network Security Analyst

Domain 2Objective 2

2.2 Create and Apply NAT Policies NETWORK-SECURITY-ANALYST Practice Questions (Page 4)

Part of the Policy Creation and Application domain, which accounts for 30% of the NETWORK-SECURITY-ANALYST exam.

21questions here

5free pages

7concepts

30%of the exam

Questions 16–20

16expert · hard
An administrator is troubleshooting a NAT issue where internal users can access the internet, but the return traffic is not reaching them. The firewall has a source NAT policy that translates Trust to Untrust. The administrator checks the session table and sees that the session is established. What is the most likely cause?
Select an answer first
17foundation · easy
Which type of NAT policy is used to translate the source address of outbound traffic from a private network to a public address?
Select an answer first
18foundation · easy
When would you use a destination NAT policy on a Palo Alto Networks firewall?
Select an answer first
19application · medium
Users report that they cannot reach an internal server from the internet. The firewall has a destination NAT policy that translates the public IP 203.0.113.20 to the private IP 10.10.1.20 for service HTTPS. A security policy allows HTTPS from the Untrust zone to the DMZ zone. The administrator checks the traffic logs and sees that packets are being dropped. What should the administrator check next to diagnose the issue?
Select an answer first
20expert · hard
An administrator has configured a destination NAT policy for a web server. The security policy allows HTTPS from Untrust to DMZ. Users can access the web server from the internet, but the server logs show that the source IP of the clients is the firewall's internal IP (10.10.1.1) instead of the actual client IP. What is the most likely cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NETWORK-SECURITY-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NETWORK-SECURITY-ANALYST” is a trademark of its owner, used for identification only.

2.2 Create and Apply NAT Policies NETWORK-SECURITY-ANALYST Practice Questions (Page 4)

Questions 16–20

Which type of NAT policy is used to translate the source address of outbound traffic from a private network to a public address?

When would you use a destination NAT policy on a Palo Alto Networks firewall?

Keep studying — Policy Creation and Application