Exam PCNSA topic 1 question 168 discussion

Actual exam question from Palo Alto Networks's PCNSA

Question #: 168
Topic #: 1

Refer to the exhibit. An administrator is using DNAT to map two servers to a single public IP address. Traffic will be steered to the specific server based on the application, where Host A (10.1.1.100) receives HTTP traffic and Host B (10.1.1.101) receives SSH traffic.

Which two Security policy rules will accomplish this configuration? (Choose two.)

A. Untrust (Any) to DMZ (1.1.1.100), ssh - Allow
B. Untrust (Any) to Untrust (10.1.1.1), web-browsing - Allow
C. Untrust (Any) to Untrust (10.1.1.1), ssh - Allow
D. Untrust (Any) to DMZ (10.1.1.100, 10.1.1.101), ssh, web-browsing - Allow
E. Untrust (Any) to DMZ (1.1.1.100), web-browsing - Allow

Show Suggested Answer

Suggested Answer: AE 🗳️

by Oteslar at Dec. 13, 2022, 11:13 a.m.

Comments

Submit Cancel

mirko1976

3 months, 2 weeks ago

Selected Answer: DE

1. Understanding DNAT in this scenario: Public IP (1.1.1.100) is mapped to two different private IPs based on the destination port. HTTP (Port 80) → 10.1.1.100 SSH (Port 22) → 10.1.1.101 2. How security policies evaluate traffic in DNAT? Security policies use post-NAT (translated) IP addresses when defining the destination. However, in some cases, you may also need to define rules for pre-NAT addresses depending on the firewall behavior. Checking Answer Choices: A. Incorrect – Uses 1.1.1.100 (pre-NAT) as the destination, but for SSH, the correct post-NAT IP is 10.1.1.101. B. Incorrect – The destination should be DMZ, not Untrust. C. Incorrect – Uses Untrust to Untrust, which is incorrect. The policy should be from Untrust to DMZ. D. Correct – Covers traffic from Untrust to DMZ, allowing SSH (for 10.1.1.101) and Web Browsing (for 10.1.1.100). E. Correct – Covers web-browsing (Port 80) but uses 1.1.1.100 (pre-NAT). Some firewall configurations require allowing traffic to the public IP before NAT is applied.

upvoted 1 times

...