Exam PCNSE All Questions

View all questions & answers for the PCNSE exam

Exam PCNSE topic 1 question 42 discussion

Actual exam question from Palo Alto Networks's PCNSE

Question #: 42
Topic #: 1

An administrator wants multiple web servers in the DMZ to receive connections initiated from the internet. Traffic destined for 206.15.22.9 port 80/TCP needs to be forwarded to the server at 10.1.1.22
Based on the information shown in the image, which NAT rule will forward web-browsing traffic correctly?

A.

B.

C.

D.

Show Suggested Answer

Suggested Answer: C

by Gulty1986 at March 18, 2021, 2:23 a.m.

Comments

Submit Cancel

UFanat

Highly Voted 3 years, 1 month ago

C is correct. You should distinguish questions for NAT and security rules (the only difference in destination zone - Internet for NAT rules and DMZ for policy rules)

upvoted 13 times

GheeHong

3 years ago

Ya, C is correct.

upvoted 1 times

...

Pakawat

3 years ago

Yes, it is C this is NAT rule not security rule.

upvoted 1 times

...

Kane002

Highly Voted 3 years, 8 months ago

C. NAT zones are just whatever interface traffic is going to. The source (the big cloud internet) is obviously internet, and the destination zone is the internet facing interface of the firewall, so the destination is also internet. It then is translated into an IP that the internal network can read.

upvoted 6 times

...

kabuelenain

Most Recent 5 months, 2 weeks ago

This is a question about NAT policies NOT security policies: So the PRE-NAT destination IP and Zone should be specified. Answer C is the correct answer.

upvoted 1 times

...

AKREM86

10 months, 3 weeks ago

D is correct - Pre-NAT headers | Post NAT Destination Zone should be considered

upvoted 4 times

...

bing2021

1 year ago

C is correct, NAT rule interface is before translate, and there is another translate section

upvoted 1 times

...

Marshpillowz

1 year, 6 months ago

C is the correct answer

upvoted 1 times

...

Pallab_Kundu

2 years, 4 months ago

Correct Answer is D

upvoted 3 times

DatITGuyTho1337

1 year, 7 months ago

No, correct answer is C. :)

upvoted 2 times

...

Jared28

3 years, 5 months ago

C - Based on live production use - Those thinking it is D, if it were not DNAT to a specific port (but all ports), this would be correct (dest zone of the device). However, since a dest svc is specified, it's only translating specific port(s), the destination zone would still be Internet.

upvoted 3 times

...