Palo Alto Networks (PANW) Certified Network Security Administrator (PCNSA) Practice Exam

What is the appropriate NAT policy configuration to match traffic from a source of 192.168.1.10 in the Trust-L3 zone to a destination of 2.2.2.2 in the Untrust-L3 zone?

1. Source 192.168.1.10, Destination 2.2.2.2

2. Source 2.2.2.2, Destination 192.168.1.10

3. Source 192.168.1.10, Destination any

4. Source any, Destination 2.2.2.2

The correct answer is: Source 192.168.1.10, Destination 2.2.2.2

The correct choice involves specifying both the source and destination in the NAT policy to accurately match the intended traffic flow between the Trust-L3 and Untrust-L3 zones. In this case, the NAT rule is set to match traffic originating from the specific source IP address of 192.168.1.10 and directed toward the destination IP address of 2.2.2.2. By defining both the source and destination in this manner, the NAT policy can effectively execute the necessary address translation and security functions. This specificity ensures that when traffic from 192.168.1.10 seeks to reach 2.2.2.2, the appropriate translation occurs, allowing the packet to be processed in a controlled and secure manner. Using "Destination any" can be too broad as it would not limit the traffic specifically to 2.2.2.2, hence not providing the exact traffic match needed for a precise NAT translation. Similarly, matching on a source of 2.2.2.2 or using "Source any" lacks the specificity required to correctly identify and handle the traffic flow from the Trust zone to the Untrust zone. Thus, the focus on both known source and destination IPs ensures proper traffic identification and processing