Refer to the exhibit. A web server in the DMZ is being mapped to a public address through DNAT.
Which Security policy rule will allow traffic to flow to the web server?
Exam PCNSA All QuestionsBrowse all questions from this exam
Question 159
Correct Answer: A
To allow traffic to flow to the web server in the DMZ through a security policy rule, the rule must permit traffic from the Untrust zone to the DMZ zone and should specify the internal IP address of the web server, which in this case is 10.1.1.100. Thus, the correct security policy rule would allow traffic from Untrust (any) to DMZ (10.1.1.100) for web browsing, allowing. This ensures that traffic is correctly matched and permitted based on the internal address translation.
Discussion
Surfside92Option: D
The given answer D is correct - my previous answers are wrong. There's 2 policies at play here - the security and NAT policy. I thought the question related to the NAT policy - it doesn't - it asks about the security policy.
OteslarOption: A
the key in this question is Security policy rule, the traffic will flow through the firewall within two rules, Nat rule policy+Security rule policy.
PunkSpOption: A
Must be A. You create the rule to the internal ip.
Russ_A7xOption: A
Pre IP > post zone for incoming traffic
Kvant
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/nat/nat-configuration-examples/destination-nat-exampleone-to-one-mapping#ide8f6a4b3-f875-4855-acb5-5fd9ad918d04
Grace_ShuOption: D
Answer is D: Zone: After NAT Address: Before NAT
Aaron_0801Option: D
Answer is D "It then evaluates and applies any security policies that match the packet based on the original (pre-NAT) source and destination addresses, but the post-NAT zones". https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/nat/nat-policy-rules/nat-policy-overview#:~:text=It%20then%20evaluates%20and%20applies%20any%20security%20policies%20that%20match%20the%20packet%20based%20on%20the%20original%20(pre%2DNAT)%20source%20and%20destination%20addresses%2C%20but%20the%20post%2DNAT%20zones
noloxOption: D
As @Surfside92 mentioned, according to CBT Nuggets video (watched the same) answer should be B. However, @ntir shared the link which shows literally this situation. I would go with D because it's from PA site.
ntirOption: D
D https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/nat/nat-configuration-examples/destination-nat-exampleone-to-one-mapping#ide8f6a4b3-f875-4855-acb5-5fd9ad918d04
BeforeScopeOption: D
answer D
Surfside92Option: C
I've labbed this using a cbtnuggets video. Within the rule you specify the dmz server global ip address and actual local address
Surfside92
Sorry - meant answer b -